A shared access policy comprises a set of permissions (read, write, delete, and list), combined with start and expiration times for the validity of the policy. There are no restrictions on the start and expiration times for a shared access policy. A container-level access policy is a shared access policy associated by name with a container. A maximum of five container-level access policies can be associated simultaneously with a container, but each must have a distinct name.

A container-level access policy improves the management of shared access signatures. There is no way to retract or otherwise disallow a standalone shared access signature once it has been created. However, a shared access signature created from a container-level access policy has validity depending on the container-level access policy. The deletion of a container-level access policy causes the revocation of all shared access signatures derived from it, and they can no longer be used...