How to get time based access for user for storage account

Question

How to get time based access for user for storage account

sns 9,246

How to get time based access for user for storage account, Please suggest.

sns 9,246 Reputation points

2023-01-20T13:11:11.3433333+00:00

Hi Sumarigo,

Thank you for the response. It is for the azure user.

what if it is azure user?

if it is not azure user?

what is meant by different user? does it mean other than admin?
Sumarigo-MSFT 47,466 Reputation points Microsoft Employee Moderator

2023-01-20T13:21:02.3333333+00:00

@sns Still if it's a Azure user or external(different) user you can use shared access signature (SAS).
shared access signature (SAS) is the only option for time based access.

Shared access signatures is the best option for your scenario. Where you can set start and expiry time & date for your storage account

Shared access signatures for blobs, files, queues, and tables. Shared access signatures (SAS) provide limited delegated access to resources in a storage account via a signed URL. The signed URL specifies the permissions granted to the resource and the interval over which the signature is valid. A service SAS or account SAS is signed with the account key, while the user delegation SAS is signed with Azure AD credentials and applies to blobs only. For more information, see Using shared access signatures (SAS).

Your storage account access keys are similar to a root password for your storage account. Always be careful to protect your access keys. Use Azure Key Vault to manage and rotate your keys securely. Avoid distributing access keys to other users, hard-coding them, or saving them anywhere in plain text that is accessible to others. Rotate your keys if you believe they may have been compromised.

Important

Microsoft recommends using Azure Active Directory (Azure AD) to authorize requests against blob, queue, and table data if possible, rather than using the account keys (Shared Key authorization). Authorization with Azure AD provides superior security and ease of use over Shared Key authorization.

To protect an Azure Storage account with Azure AD Conditional Access policies, you must disallow Shared Key authorization for the storage account. For more information about how to disallow Shared Key authorization, see Prevent Shared Key authorization for an Azure Storage account.

Accepted answer

0 additional answers

Your answer

sns 9,246 Reputation points

2023-01-20T13:11:11.3433333+00:00

Hi Sumarigo,

Thank you for the response. It is for the azure user.

what if it is azure user?

if it is not azure user?

what is meant by different user? does it mean other than admin?
Sumarigo-MSFT 47,466 Reputation points Microsoft Employee Moderator

2023-01-20T13:21:02.3333333+00:00

@sns Still if it's a Azure user or external(different) user you can use shared access signature (SAS).
shared access signature (SAS) is the only option for time based access.

Shared access signatures is the best option for your scenario. Where you can set start and expiry time & date for your storage account

Shared access signatures for blobs, files, queues, and tables. Shared access signatures (SAS) provide limited delegated access to resources in a storage account via a signed URL. The signed URL specifies the permissions granted to the resource and the interval over which the signature is valid. A service SAS or account SAS is signed with the account key, while the user delegation SAS is signed with Azure AD credentials and applies to blobs only. For more information, see Using shared access signatures (SAS).

Your storage account access keys are similar to a root password for your storage account. Always be careful to protect your access keys. Use Azure Key Vault to manage and rotate your keys securely. Avoid distributing access keys to other users, hard-coding them, or saving them anywhere in plain text that is accessible to others. Rotate your keys if you believe they may have been compromised.

Important

Microsoft recommends using Azure Active Directory (Azure AD) to authorize requests against blob, queue, and table data if possible, rather than using the account keys (Shared Key authorization). Authorization with Azure AD provides superior security and ease of use over Shared Key authorization.

To protect an Azure Storage account with Azure AD Conditional Access policies, you must disallow Shared Key authorization for the storage account. For more information about how to disallow Shared Key authorization, see Prevent Shared Key authorization for an Azure Storage account.

Answer 1

@sns Welcome to Microsoft Q&A Forum, Thank you for posting your query here!
As I understand you need to provide a access(Read/Write/delete) to Azure Storage account for different user only for some time am I correct, If not please correct me?
If, so you can you Azure Shared Access Signature : Grant limited access to Azure Storage resources using shared access signatures (SAS) You can set expiry time and date for your Storage account.

User's image

In this article, you'll learn how to create user delegation, shared access signature (SAS) tokens, using the Azure portal or Azure Storage Explorer. User delegation SAS tokens are secured with Azure AD credentials. SAS tokens provide secure, delegated access to resources in your Azure storage account.

Learn about the different ways to authorize access to data in Azure Storage. Authorize access to data in Azure Storage

Please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

How to get time based access for user for storage account

0 additional answers

Your answer