Create an account SAS

Beginning with version 2015-04-05, Azure Storage supports creating a new type of shared access signature (SAS) at the level of the storage account. Creating an account SAS enables you to:

• Delegate access to service-level operations that are not currently available with a service-specific SAS, such as the Get/Set Service Properties and Get Service Stats operations.

• Delegate access to more than one service in a storage account at a time. For example, you can delegate access to resources in both the Blob and File services with an account SAS.

• Delegate access to write and delete operations for containers, queues, tables, and file shares, which are not available with an object-specific SAS.

• Specify an IP address or range of IP addresses from which to accept requests.

• Specify the HTTP protocol from which to accept requests (either HTTPS or HTTP/HTTPS).

Stored access policies are currently not supported for account SAS.

Authorization of an account SAS

An account SAS is secured using the storage account key. To create an account SAS, a client application must possess the account key.

To use Azure AD credentials to secure a SAS for a container or blob, create a user delegation SAS. For more information, see Create a user delegation SAS.

Constructing the Account SAS URI

The account SAS URI consists of the URI to the resource for which the SAS will delegate access, followed by the SAS token. The SAS token is the query string that includes all of the information required to authorize a request to the resource, as well as to specify the service, resource, and permissions available for access, and the time interval over which the signature is valid.

Specifying Account SAS Parameters

The following table describes the required and optional parameters for the SAS token.

Constructing the signature string

To construct the signature string for an account SAS, first construct the string-to-sign from the fields comprising the request, then encode the string as UTF-8 and compute the signature using the HMAC-SHA256 algorithm. Note that fields included in the string-to-sign must be URL-decoded.

To construct the string-to-sign for an account SAS, use the following format:

StringToSign = accountname + "\n" +  
    signedpermissions + "\n" +  
    signedservice + "\n" +  
    signedresourcetype + "\n" +  
    signedstart + "\n" +  
    signedexpiry + "\n" +  
    signedIP + "\n" +  
    signedProtocol + "\n" +  
    signedversion + "\n"  
  

Version 2020-12-06 adds support for the signed encryption scope field. To construct the string-to-sign for an account SAS, use the following format:

StringToSign = accountname + "\n" +  
    signedpermissions + "\n" +  
    signedservice + "\n" +  
    signedresourcetype + "\n" +  
    signedstart + "\n" +  
    signedexpiry + "\n" +  
    signedIP + "\n" +  
    signedProtocol + "\n" +  
    signedversion + "\n" +
    signedEncryptionScope + "\n"  
  

Account sas permissions by operation

The tables in the following sections list various APIs for each service and the signed resource types and signed permissions supported for each operation.

Blob service

The following table lists Blob service operations and indicates which signed resource type and signed permissions to specify to delegate access to those operations.

Queue service

The following table lists Queue service operations and indicates which signed resource type and signed permissions to specify to delegate access to those operations.

Table service

The following table lists Table service operations and indicates which signed resource type and signed permissions to specify to delegate access to those operations.

¹Add and Update permissions are required for upsert operations on the Table Service.

File Service

The following table lists File service operations and indicates which signed resource type and signed permissions to specify to delegate access to those operations.

Account SAS URI example

The following example shows an account SAS URI that provides read and write permissions to a blob. The table breaks down each part of the URI:

https://myaccount.blob.core.windows.net/?restype=service&comp=properties&sv=2019-02-02&ss=bf&srt=s&st=2019-08-01T22%3A18%3A26Z&se=2019-08-10T02%3A23%3A26Z&sr=b&sp=rw&sip=168.1.5.60-168.1.5.70&spr=https&sig=F%6GRVAZ5Cdj2Pw4tgU7IlSTkWgn7bUkkAg8P6HESXwmf%4B

Given that permissions are restricted to the service level, accessible operations with this SAS are Get Blob Service Properties (read) and Set Blob Service Properties (write). However, with a different resource URI, the same SAS token could also be used to delegate access to Get Blob Service Stats (read).

See also

• Delegate access with a shared access signature
• Create a user delegation SAS
• Create a service SAS
• SAS Error Codes