{
  "slug": "storage-sas-generation-adds-user-delegation-oid-support-across-blob-container-fi-83d5bfa4d5a0",
  "title": "Storage SAS generation adds user delegation OID support across blob, container, file system, directory, share, file, and queue commands",
  "tools": [
    "az"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-01-13T00:00:00.000Z",
  "announced_at": "2026-01-13T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When generating a SAS for a supported Azure Storage resource, add `--user-delegation-oid <user-object-id>` to that resource’s `generate-sas` command. For share, file, and queue SAS commands, use `--as-user` as well; the documented `--as-user` option requires `--expiry` and `--auth-mode login`.",
    "examples": [
      "az storage blob generate-sas --account-name <storage-account> --container-name <container> --name <blob> --permissions <permissions> --expiry <date-time> --auth-mode login --as-user --user-delegation-oid <user-object-id>",
      "az storage fs file generate-sas --file-system <file-system> --path <file-path> --https-only --permissions <permissions> --expiry <date-time> --user-delegation-oid <user-object-id>",
      "az storage share generate-sas --name <share> --account-name <storage-account> --https-only --permissions <permissions> --expiry <date-time> --auth-mode login --as-user --user-delegation-oid <user-object-id>"
    ],
    "gotchas": [
      "Version: 2.82.0",
      "--user-delegation-oid <user-object-id>: Entra ID of the user authorized to use the resulting SAS URL; that URL must be used with an Entra ID token issued to that user.",
      "--as-user: Return a SAS signed with the user delegation key. Requires `--expiry` and `--auth-mode login`.",
      "--auth-mode {key, login}: Select authentication mode; `login` uses login credentials. Required with `--as-user`.",
      "--expiry <date-time>: SAS expiration time; required with `--as-user`.",
      "--name <blob> (required): Blob name for `az storage blob generate-sas`.",
      "--container-name <container>: Container containing the blob; required unless another documented resource locator is used.",
      "--file-system <file-system> (required): ADLS Gen2 file system name.",
      "--path <file-path> (required): File path in the file system.",
      "--name <share> (required): File share name.",
      "--permissions <permissions>: Permissions granted by the SAS; accepted permission values depend on the resource.",
      "--https-only: Allow requests only over HTTPS.",
      "Prerequisite: Sign in to Azure CLI with Microsoft Entra credentials; the CLI user needs an Azure RBAC role containing `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`.",
      "Prerequisite: The cited Azure CLI guide specifies Azure CLI version 2.0.78 or later for creating a user delegation SAS.",
      "`az storage fs file generate-sas` is added as a command.",
      "`--as-user` is stated for the share, file, and queue SAS commands."
    ]
  },
  "why_it_matters": "Generate a user delegation SAS for a supported Azure Storage resource.",
  "sources": [
    "https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026",
    "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-cli",
    "https://learn.microsoft.com/en-us/cli/azure/storage/fs/file?view=azure-cli-latest",
    "https://learn.microsoft.com/en-us/cli/azure/storage/share?view=azure-cli-latest",
    "https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest"
  ],
  "rank": 0.92035,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-c29eb3dbc09751c1-32:gate",
    "evidence_hash": "42320531b444a4bc82079da9ee2022a91d2298eb2416d4388fb33e7f5d5788a9"
  },
  "review": {
    "draft_hash": "b6c359821fc0f1791d32b8577ba4db0634409a2614fb860ebcedb95cdb861457",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.71 (>= 0.6 needed)."
  }
}