Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity

Mon, 14 Sep 2026 18:30:00 +0530

Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity

Every SAS token you've ever generated for Azure Storage has the same underlying weakness: it's a bearer credential. Whoever holds the URL — the person you sent it to, whoever they forwarded it to, whoever it leaked to in a log line or a Slack message or a public GitHub gist — can use it, for as long as it's valid, with no way for Azure to tell the difference between the intended recipient and anyone else holding the string. A 7-day user delegation SAS "expiring soon" is cold comfort if it's been sitting in a misconfigured public bucket for six of those days.

Entra ID on Cloudkaramchari

Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity

Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity