Create a User Delegation SAS Using Azure CLI

Pluralsight Hands-On Lab — Azure Storage Security

Create a User Delegation SAS Using Azure CLI

Pluralsight Hands-On Lab — Storage

At a Glance

Platform	Pluralsight
Category	Azure Storage Security
Lab Type	Guided + Challenge Mode
Environment	Azure Portal, Azure Cloud Shell (Bash)
Completed	2026

Overview

A user delegation SAS is a more secure alternative to a standard Shared Access Signature because it is backed by an Azure Active Directory identity rather than a storage account key. This means access can be revoked by revoking the delegation keys rather than rotating the account key. In this lab, I uploaded a file to a private blob container, generated a user delegation SAS using Azure CLI with scoped permissions and a time-bound expiry, validated access via the generated URL, and then revoked the SAS by invalidating all user delegation keys on the storage account.

What I Did

Uploaded a file to the pre-existing private blob container (container1) and confirmed direct URL access was denied due to the private access level

Opened Azure Cloud Shell in Bash mode and generated a user delegation SAS using the following command structure:

az storage blob generate-sas --account-name <account> \
  --container-name container1 \
  --name <filename> \
  --permissions acdrw \
  --expiry <YYYY-MM-DD> \
  --auth-mode login \
  --as-user \
  --full-uri

Confirmed the generated full URI returned accessible blob content in the browser, validating the SAS worked as expected

Revoked all user delegation keys on the storage account using:

az storage account revoke-delegation-keys --name <account> --resource-group <rg>

Waited for propagation and confirmed the previously working SAS URL returned an AuthenticationFailed error, demonstrating that revoking delegation keys immediately invalidates all associated user delegation SAS tokens

← Back to Pluralsight Labs