Generally Available: User-bound user delegation SAS for Azure Storage

Announcing the addition of enhanced secure authentication in Azure Storage that combines the flexibility of user-delegation shared access signature (SAS) with the user-bound access of Entra ID. User-bound user delegation SAS is now generally available for all regions.

User delegation SAS is an existing feature that allows users to create secure SAS tokens that are tied to the delegator, meaning the delegator must verify their identity with Entra to create the token. The resulting token can be traced to the delegator and can only be valid for up to 7 days. This feature is an extension of user delegation (UD) SAS, which is already generally available for Azure Blobs, Azure Files, Azure Tables, and Azure Queues. User-bound user delegation SAS allows users to create a more secure SAS token than account SAS, service SAS, or normal user delegation SAS by restricting the usage of the SAS token to an end user identity. This will help enforce that the user delegated SAS can only be used by intended users.

There is no additional cost to use user-bound user delegation SAS. Pricing is based on standard transaction costs for your storage account type, refer to Azure Storage Pricing for details.

This feature is available in all public regions.

Learn more:

• Create a user delegation SAS
• Read the announcement blog