Skip to main content
Shared Access Signatures (SAS) provide a secure, granular way to grant time-limited access to Azure Storage resources without exposing your storage account keys. SAS tokens let you control which operations are allowed (for example: read, write, delete, list), the resources those operations apply to, and how long access is valid. Key phrases: Azure Shared Access Signature, SAS token, Service SAS, Account SAS, User Delegation SAS, Azure AD, storage account keys, blob storage. Types of SAS
  • Service SAS — Grants scoped access to resources within a single service (for example, a specific blob container or blob). Use this for fine-grained resource-level permissions.
  • Account SAS — Grants access across multiple services (blob, file, queue, table) within a storage account. Use this for broader, cross-service scenarios.
  • User Delegation SAS — Issued after authenticating with Microsoft Entra ID (Azure AD). The storage service returns a user delegation key, and the SAS is signed with that key instead of the account key. Use this to avoid exposing account keys and to integrate Azure AD authentication.
A screenshot of a "Shared Access Signature" settings page showing checkboxes for allowed services, resource types, permissions, start/end date-time fields and protocol options. Two colored panels on the left read "Fine-tuned access" and "Three types of SAS keys."
Understanding the SAS URI A SAS-protected resource URL has two parts:
  1. Resource endpoint — the storage resource endpoint, for example the blob endpoint for your storage account.
  2. SAS token — a query string of signed parameters that define scope, permissions, and validity.
Example split:
Common SAS token parameters Detailed example (consolidated)
Notes about signatures and keys
  • Account SAS tokens are signed with your storage account keys. If you regenerate the account key that signed an existing SAS, all SAS tokens created with that key become invalid.
  • User Delegation SAS tokens are issued after you authenticate with Azure AD and request a user delegation key from the storage service. These SAS tokens do not depend on the account keys in the same way and are useful for integrating with Azure AD.
  • Limit scope: always minimize permissions (sp), restrict IP ranges (sip), prefer HTTPS only (spr=https), and set short expiry times (se) to reduce exposure.
If you regenerate a storage account key, any SAS tokens signed with that key will be revoked. Plan key rotation carefully to avoid unexpected service disruptions.
Best practice: prefer User Delegation SAS (Azure AD) for scenarios where you can authenticate users with Microsoft Entra ID. Use Account SAS for automation scenarios that need cross-service access, and Service SAS for precise resource-level access.
Portal walkthrough — create and test a SAS
  1. Make the container private
    • In your storage account, open Containers and select the container (for example, images).
    • Set Public access level to Private (no anonymous access). This ensures only authenticated or SAS-authenticated requests can read objects.
  2. Access storage account keys and the SAS generator
    • In the storage account blade:
      • Open Access keys to view account-level keys and connection strings (useful for REST or SDK scenarios).
      • Open Shared access signature to configure SAS options: select services, resource types, permissions, start/end times, allowed IPs, protocol (use HTTPS only), and choose the signing key (Key1 or Key2).
    • Important: selecting Key1 or Key2 determines the signing key. Regenerating that key invalidates SAS tokens signed with it.
  3. Generate the SAS token and test access
    • Click Generate, copy the SAS query string, append it to the blob URL, and open it in a browser. If the SAS includes the required permissions (for example, sp=r to read) and is valid, the blob will be accessible.
    • If the token is tampered with, expired, or signed with a now-regenerated key, requests will fail authentication.
A screenshot of the Microsoft Azure portal showing an "images" blob container with a list of image files on the left and the properties/overview pane for "City1.jpg" on the right (URL, size, content-type, etc.).
Example: append a SAS to access a blob If the blob URL is:
and the SAS token is:
Then the full URL:
will allow access until the SAS expires or until the signing key is regenerated (for Account SAS). If the SAS token is removed or altered (for example, modifying se or sig), authentication will fail and access will be denied. Quick reference summary Links and references Summary
  • Choose the SAS type to match your security and access needs.
  • Keep permissions, IP ranges, protocols, and expiry as restrictive as possible.
  • Prefer Azure AD (User Delegation SAS) when you can; otherwise plan account key rotation to avoid breaking existing SAS tokens.

Watch Video