Shared Access Signature Types Comparison

A Shared Access Signature (SAS) is a signed URL that provides limited, delegated access to Azure Storage resources. Clients must always use HTTPS to distribute tokens. Grant only the minimum necessary permissions for the shortest duration. There are three main types: User Delegation SAS, Service SAS, and Account SAS. Microsoft recommends a User Delegation SAS for blob data because it is secured using Microsoft Entra ID credentials instead of storage account keys, reducing risk. Setting short expiration times, such as one hour or less, mitigates the risk of leaked tokens. For better control, use a stored access policy to manage service-level signatures. A stored access policy is defined on a container and can be modified or deleted to revoke all linked signatures instantly. Store storage account keys in Azure Key Vault and rotate them periodically. For maximum security, disable shared key authorization and force all clients to authenticate with Microsoft Entra ID.