Possible to Generate File Share SAS with Managed Identity?

Question

We have been attempting to move most storage services access from our App Services to use Managed Identities with the appropriate minimum RBAC roles. For Azure Files services it seems clear that direct Managed Identity access is not currently supported. e.g. https://learn.microsoft.com/en-us/answers/questions/412668/azure-web-app-to-azure-file-share-using-managed-id

Would it be possible for the Managed Identity to instead generate a SAS token for the service to be used, or would the generation of the token fall under the same constraints?

We want to avoid potential issues and maintenance that could arise from things like SAS token expiry and key rotation.

Answer 1

Hi,

If I understand correctly what you would like to do it is not currently possible. Creating Service SAS for Azure Files requires storage account key since User delegated SAS can only be used for blob storage. Please see documentation below for more information:

https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview#user-delegation-sas

If the above was helpful please click Accept Answer.

Thanks.

-TP