Azure User-Bound Delegation SAS Is GA: Lock Storage Tokens to a Single Entra Identity Every SAS token you've ever generated for Azure Storage has the same underlying weakness: it's a bearer credential. Whoever holds the URL — the person you sent it to, whoever they forwarded it to, whoever it leaked to in a log line or …