Storage SAS generation adds user delegation OID support across blob, container, file system, directory, share, file, and queue commands

Introduced 2026-01-13 · score 0.92

HOW TO USE IT

When generating a SAS for a supported Azure Storage resource, add `--user-delegation-oid <user-object-id>` to that resource’s `generate-sas` command. For share, file, and queue SAS commands, use `--as-user` as well; the documented `--as-user` option requires `--expiry` and `--auth-mode login`.

WHY THIS HELPS

Generate a user delegation SAS for a supported Azure Storage resource.

REQUIREMENTS AND LIMITATIONS

• Version: 2.82.0
• --user-delegation-oid <user-object-id>: Entra ID of the user authorized to use the resulting SAS URL; that URL must be used with an Entra ID token issued to that user.
• --as-user: Return a SAS signed with the user delegation key. Requires `--expiry` and `--auth-mode login`.
• --auth-mode {key, login}: Select authentication mode; `login` uses login credentials. Required with `--as-user`.
• --expiry <date-time>: SAS expiration time; required with `--as-user`.
• --name <blob> (required): Blob name for `az storage blob generate-sas`.
• --container-name <container>: Container containing the blob; required unless another documented resource locator is used.
• --file-system <file-system> (required): ADLS Gen2 file system name.
• --path <file-path> (required): File path in the file system.
• --name <share> (required): File share name.
• --permissions <permissions>: Permissions granted by the SAS; accepted permission values depend on the resource.
• --https-only: Allow requests only over HTTPS.
• Prerequisite: Sign in to Azure CLI with Microsoft Entra credentials; the CLI user needs an Azure RBAC role containing `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`.
• Prerequisite: The cited Azure CLI guide specifies Azure CLI version 2.0.78 or later for creating a user delegation SAS.
• `az storage fs file generate-sas` is added as a command.
• `--as-user` is stated for the share, file, and queue SAS commands.

FIRST-PARTY EVIDENCE

• https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026
• https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-cli
• https://learn.microsoft.com/en-us/cli/azure/storage/fs/file?view=azure-cli-latest
• https://learn.microsoft.com/en-us/cli/azure/storage/share?view=azure-cli-latest
• https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest

Check the installed version and the source before using it. Entry JSON

Report a problem with this card