Introduction
When creating a Shared Access Signature (SAS) in Azure, one important setting is the Signing Method. This determines how the SAS token is authenticated and secured. Azure provides two signing methods:
- Account Key
- User Delegation Key
What is Signing in SAS Tokens?
Signing in the context of SAS tokens refers to the process of creating a digital signature that validates the authenticity and integrity of the token. This signature is appended to the SAS URL and is used by Azure to verify that the access request complies with the permissions and constraints specified in the SAS.
The signing method determines the key used to generate this digital signature:
- Account Key: Uses the primary or secondary storage account key.
- User Delegation Key: Uses a key tied to Azure AD and associated with specific user roles.
Let’s break them down in simple terms to help you understand when and why to use each.
1. Account Key
This is the traditional signing method for generating SAS tokens.
What is it?
- The SAS is signed using the primary or secondary account key of the Azure Storage account.
- It allows access to storage resources without requiring Azure Active Directory (Azure AD).
When to Use It:
- For applications that are not integrated with Azure AD.
- When granting broader access to resources across your storage account.
- For backward compatibility with legacy systems.
Security Considerations:
- Sharing an account key gives full control over the storage account, so be cautious.
- Rotate account keys regularly to maintain security.
2. User Delegation Key
This is a more modern and secure option.
What is it?
- The SAS is signed using a user delegation key, which is tied to Azure AD.
- The key is generated on behalf of an Azure AD user or service principal with assigned roles.
When to Use It:
- For scenarios requiring user-specific permissions.
- When you want enhanced security by tying the SAS to Azure AD.
- To restrict access to only Blob Storage resources.
Note: User Delegation SAS is supported for Blob Storage and Data Lake Storage but is not currently available for Queue Storage, Table Storage, or Azure Files.
Benefits:
- Permissions are tied to Azure AD roles, providing fine-grained control.
- More secure than sharing an account key.
- SAS validity is limited by the lifetime of the user delegation key (up to 7 days).
Why is it Called a User Delegation Key?
The User Delegation Key gets its name from its purpose and functionality:
- User: The key is tied to an Azure AD user or service principal, with permissions based on their assigned roles.
- Delegation: Azure delegates access control to Azure AD, dynamically generating the key based on the user’s permissions.
- Key: It is a cryptographic key used to sign SAS tokens, ensuring that access is tied to the user’s identity and Azure AD role.
This mechanism enables secure, user-specific, role-based access to Azure Blob Storage, offering fine-grained control and enhanced security compared to traditional Account Keys.
Key Differences Between Account Key and User Delegation Key
| Feature | Account Key | User Delegation Key |
|---|---|---|
| Authentication | Uses storage account key | Uses Azure AD authentication |
| Scope | Entire storage account | Blob Storage resources only |
| Security | Less secure, full access via account key | More secure, tied to Azure AD roles |
| Best For | Legacy systems or broad access | Modern applications with Azure AD |
| Access Management | Hard to manage individual permissions | Managed via Azure RBAC |
Which One Should You Choose?
- Account Key: Use this if you’re working with older systems or need access to multiple storage services like queues and tables.
- User Delegation Key: Use this if you need enhanced security and are working with Azure Blob Storage. It’s ideal for modern, Azure AD-integrated solutions.
How to Set the Signing Method in Azure Portal
- Navigate to your Storage Account.
- Select the resource (e.g., Blob, Container).
- Go to Shared Access Tokens under settings.
- Choose the Signing Method:
- Account key (default).
- User delegation key (requires Azure AD roles).
- Generate the SAS token or URL.
Conclusion
The signing method you choose depends on your access needs and security requirements. While the Account Key method is simpler and compatible with legacy systems, the User Delegation Key provides stronger security by leveraging Azure AD.
For modern applications, always prefer the User Delegation Key to take advantage of Azure AD’s role-based access control and enhanced security features. By understanding these methods, you can make the right choice for your SAS tokens and ensure your resources are accessed securely.
See also
Read the blog post What is a stored access policy in azure.