Shared access signatures and account keys

Load your storage account name and make an expiry time one hour from now:

$st = (Get-Content C:\azure-lab\storage.txt)
$exp = (Get-Date).ToUniversalTime().AddHours(1).ToString('yyyy-MM-ddTHH:mmZ')

1Look at the account keys, without printing them

Run this:

az storage account keys list --resource-group rg-saat-data --account-name $st --query "[].{name:keyName, permissions:permissions}" -o table

You should see this:

Name    Permissions
------  -------------
key1    FULL
key2    FULL

Never print the values in a shared terminal or a ticket. Anyone who sees one has full control of the data in the account.

2Make a user delegation SAS for one file

Run this:

$url = az storage blob generate-sas --account-name $st --container-name lab --name hello.txt --permissions r --expiry $exp --https-only --auth-mode login --as-user --full-uri -o tsv
(Invoke-WebRequest -Uri $url -UseBasicParsing).Content

You should see this:

hello from lesson 21

Anyone with that URL can read hello.txt for an hour, from any browser. Your Storage Blob Data Contributor role (Lesson 21) is what let you sign it.

3Read what’s inside the token

List the fields, leaving out the signature:

([uri]$url).Query.TrimStart('?').Split('&') | Where-Object { $_ -notlike 'sig=*' }

You should see something like this:

se=2026-10-20T17%3A30Z
sp=r
spr=https
sv=2026-04-06
sr=b
skoid=3f6a...
sktid=9b1c...
skt=2026-10-20T16%3A30%3A12Z
ske=2026-10-20T17%3A30%3A00Z
sks=b
skv=2026-04-06

sp=r is read only, sr=b means one blob, and the sk* fields say which identity signed it. When a SAS fails, reading these fields is the first check.

4Prove the SAS is read only

Try to overwrite the file with it:

try { Invoke-WebRequest -Method Put -Uri $url -Headers @{'x-ms-blob-type'='BlockBlob'} -Body 'changed' -UseBasicParsing } catch { $_.Exception.Response.StatusCode.value__; $_.ErrorDetails.Message }

You should see something like this:

403
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:...
Time:...</Message></Error>

5Make a revocable SAS with a stored access policy

Create a policy on the container, sign a SAS that uses it, then delete the policy:

az storage container policy create --account-name $st --container-name lab --name pol-read --permissions r --expiry $exp -o none
$purl = az storage blob generate-sas --account-name $st --container-name lab --name hello.txt --policy-name pol-read --full-uri -o tsv
(Invoke-WebRequest -Uri $purl -UseBasicParsing).StatusCode
az storage container policy delete --account-name $st --container-name lab --name pol-read -o none
Start-Sleep -Seconds 40
try { Invoke-WebRequest -Uri $purl -UseBasicParsing } catch { $_.Exception.Response.StatusCode.value__ }

You should see this:

200
403

These commands use the account key in the background (the CLI warns you about that). Deleting the policy killed the link without touching the key. Policy changes can take up to 30 seconds to apply.

✅ Checkpoint: You read a file through a user delegation SAS, proved it can’t write, and revoked a policy-based SAS.