Azure Storage’s SAS expiration policy (validity interval) allows
you to set an upper limit for the period for validity of SAS tokens. Up until
now, administrators could set how long a SAS should be valid through the SAS
expiration policy, however, it was possible to extend this time period through
the SAS signed expiry date. SAS expiration action allows you to configure
actions for using a SAS token that doesn’t adhere to the defined SAS expiration
policy: do you want to log the event, or block the request entirely?
Auditing with ‘Log’ action helps you detect trends and
investigate access without disrupting workflows, while ‘Block’ action lets you
enforce zero-tolerance for out-of-policy SAS tokens. You can choose to get
started with ‘Log’ action to monitor your diagnostic logs and ensure your
current access patterns are not disrupted. We strongly recommend using Block
action to ensure that if a SAS token expiry interval has surpassed the validity
of the expiration period set on the storage account, then access to storage
must be blocked.
Learn more.