Azure user delegation SAS improves revocation, within cache limits

A shared access signature grants a client limited access to Azure Storage without giving it the account key. The signature is a bearer credential, so its scope, lifetime, and revocation path matter. Azure supports user delegation SAS, service SAS, and account SAS. A user delegation SAS is signed with a Microsoft Entra credential rather than the storage account key, which makes it a better fit for temporary delegated access.

The access model has two layers. The caller needs permission to obtain a user delegation key, and the resulting SAS is also constrained by the permissions encoded in the signature. Microsoft's documentation states that the security principal's RBAC or POSIX ACL permissions must also permit the operation. A SAS does not create access that the delegating identity lacks.

Revoking the user delegation key can invalidate SAS values issued from it.…