When you need granular access to Azure Storage services, you can use Shared Access Signature (SAS) tokens, which can be explicitly shaped and designed for a particular client. However, there is always a need to find a way to revoke them so that you can get rid of compromised tokens. You can achieve this by using Shared Access Policies, which are one of the security features of Azure Storage.
When generating a SAS token, you can decide whether it is an ad hoc SAS (which stores all its information about its start, expiration time, and permissions inside it) or a SAS with stored access policy (which is attached to a container and inherits its configuration). The choice directly implies which features are available to you:
- When using ad hoc signatures, you will have to have a way to revoke them when compromised.
- Ad hoc SAS tokens can be created at any time and do not rely on the configuration of a container.
- Signatures with policies need...