For more information, see Authorize access to data in Azure Storage.Ī shared access signature can take one of the following two forms:Īd hoc SAS. When your application design requires shared access signatures for access to Blob storage, use Azure AD credentials to create a user delegation SAS when possible for superior security. Microsoft recommends that you use Azure AD credentials when possible as a security best practice, rather than using the account key, which can be more easily compromised. Read, write, and delete operations that aren't permitted with a service SAS.įor more information about the account SAS, Create an account SAS (REST API). Service-level operations (For example, the Get/Set Service Properties and Get Service Stats operations). You can also delegate access to the following: All of the operations available via a service or user delegation SAS are also available via an account SAS. An account SAS delegates access to resources in one or more of the storage services. Account SASĪn account SAS is secured with the storage account key. A service SAS delegates access to a resource in only one of the Azure Storage services: Blob storage, Queue storage, Table storage, or Azure Files.įor more information about the service SAS, see Create a service SAS (REST API). Service SASĪ service SAS is secured with the storage account key.
A user delegation SAS applies to Blob storage only.įor more information about the user delegation SAS, see Create a user delegation SAS (REST API). What permissions they have to those resources.Īzure Storage supports three types of shared access signatures:Ī user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS.
With a SAS, you have granular control over how a client can access your data. A shared access signature (SAS) provides secure delegated access to resources in your storage account.
0 kommentar(er)
