We’re excited to announce the addition of enhanced
secure authentication in Azure Storage that combines the flexibility of
user-delegation shared access signature (SAS) with the user-bound access of
Entra ID. User-bound user delegation SAS is now in preview for all regions.
User delegation SAS is an existing feature that allows users
to create secure SAS tokens that are tied to the delegator, meaning the
delegator must verify their identity with Entra to create the
token. The resulting token can be traced to the delegator and can only be
valid for up to 7 days. This feature is an extension of user
delegation (UD) SAS, which is already generally available for
Azure Blobs and in public preview for Azure Files, Azure Tables,
and Azure Queues. User-bound user delegation SAS allows users to create a
more secure SAS token than account SAS, service SAS, or normal user
delegation SAS by restricting the usage of the SAS token
to an end user identity. This will help enforce
that the user delegated SAS can only be used by intended users.
There is no additional cost to
use user-bound user delegation SAS. Pricing is based on the
standard read/write transaction costs for your storage account type. To learn
more, please see Azure
Storage Pricing.
This preview is available in all public regions.
Learn
more.