Client secret and SAS expiration notification

Gozixh 66 Reputation points
2022-11-28T13:50:34.147+00:00

Are there any ways to be notified via email on expiring Azure App Registration client secrets and Shared Access Signature for Azure storage account

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,717 questions
Accepted answer
  1. Sumarigo-MSFT 43,801 Reputation points Microsoft Employee
    2022-12-02T04:48:39.127+00:00

    @Gozixh Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

    You can generate a SAS token using Powershell/azCLi/Portal and you can see it the moment you generated a SAS token in output window of Powershell/azcli/Portal. However, it is not possible to get the list of SAS URLs because they are not stored anywhere in Azure Storage at a later point in time and they cannot be monitored.

    One way is to get notified is after expiry, for which you need to create SAS expiration policy.A SAS expiration policy does not prevent a user from creating a SAS with an expiration that exceeds the limit recommended by the policy. When a user creates a SAS that violates the policy, they'll see a warning, together with the recommended maximum interval. If you have configured a diagnostic setting for logging with Azure Monitor, then Azure Storage writes a message to the SasExpiryStatus property in the logs whenever a user creates or uses a SAS that expires after the recommended interval. The message indicates that the validity interval of the SAS exceeds the recommended interval.

    When a SAS expiration policy is in effect for the storage account, the signed start field is required for every SAS. If the signed start field is not included on the SAS, and you have configured a diagnostic setting for logging with Azure Monitor, then Azure Storage writes a message to the SasExpiryStatus property in the logs whenever a user creates or uses a SAS without a value for the signed start field.

    If you wish to leave your feedback/upvote here Expiry of SAS Token for safety and tracking : . All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.

    Need to get expiry alert for Azure blob storage SAS token

    Please let us know if you have any further queries. I’m happy to assist you further.

    ----------

    Please do not forget to 266444-accept-answer.png and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 142.3K Reputation points MVP
    2022-11-28T13:52:27.223+00:00
    0 comments