thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Intermediate

Shared Access Signature (SAS)

Signed URI token granting restricted, time-limited delegated access to Azure Storage resources.

Definition

SAS types are user delegation SAS (signed with Entra ID credentials, the most secure for Blob Storage), service SAS and account SAS (signed with the account key). SAS tokens specify permissions, start and expiry times, allowed IPs and protocols. A stored access policy allows service SAS tokens to be revoked.

Example

An app issues a read-only user delegation SAS valid for one hour so a partner can download one blob.

Exam tip

Prefer user delegation SAS; to revoke an ad hoc account-key SAS you must rotate the account key.

Related terms