A shared access signature (SAS) is a signed Azure Storage authorization token that permits specified data plane operations on specified resources for a defined period. It enables delegated access without granting broader storage permissions. section 5.1.3
Use a SAS when access must be constrained by:
- Permitted operations: the token allows only the data plane operations it specifies. section 5.1.3
- Resource type: SAS supports Azure blobs, files through REST, queues, and tables. section 5.1.3
- Duration: define the period during which the signed authorization remains usable. section 5.1.3
- Scope: prefer the narrowest practical permissions rather than exposing storage account-wide access. section 5.1.3
Create a container with a SAS token
Use the Azure CLI command `az storage container create --account-name storage012 --name mycontainer --sas-token 2015-02-21&st=2015-07...`. The account name and container name identify the target; the SAS token supplies authorization.
SAS is one data plane authorization option alongside Microsoft Entra ID integration and storage account keys. Microsoft Entra ID is identified as the recommended approach for data plane authorization, while SAS provides controlled delegated access. section 5.1.3
