Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Shared access signature (SAS)

A signed URL token that grants delegated access to Azure Storage. Account and service SAS are signed with the account key; creation cannot be audited.

A shared access signature (SAS) is a token appended to a storage URL that grants specific permissions for a limited time. Azure supports user delegation SAS (signed with Entra credentials), service SAS and account SAS (both signed with the storage account key).

Microsoft states that SAS generation cannot be audited (SAS overview). Only SAS minted through Azure Resource Manager (listAccountSas, listServiceSas) and each use of a SAS — in storage logs, with a hash of the signature — leave traces. Regenerating the account keys invalidates account and service SAS.

See Azure Storage data exfiltration.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.