You need to grant temporary, time-limited access to specific files stored in a private Azure Blob Storage container to third-party clients. Security requirements dictate that you must be able to instantly revoke this access at any time before the expiration period if a client's subscription is canceled. What is the most secure and manageable way to implement this?

Question

Sunny · Accepted Answer

Generate a Shared Access Signature (SAS) token associated with a Stored Access Policy on the container. To revoke access, delete or modify the Stored Access Policy.. An ad-hoc SAS cannot be revoked individually without rotating the entire storage account keys, which invalidates all other SAS tokens. Using a Stored Access Policy on the container allows you to associate the SAS token with the policy. If you need to revoke access, you simply delete or change the policy, which immediately invalidates all SAS tokens linked to it.

📚 What This Question Tests