Create a User Delegation SAS Using Azure CLI

By using a user delegation SAS, we can help to improve the security of access to an Azure Blob storage container. Unlike a normal shared access signature (SAS), a user delegation SAS is associated with an Azure Active Directory (AAD) identity. A user delegation SAS is a service SAS that only supports Blob storage. In this lab, you will create a user delegation SAS using Azure CLI. We'll then be able to use this user delegation SAS to access a blob. After completing this lab, you'll understand how to create and revoke a user delegation SAS using Azure CLI. **Scenario** As you walk through the lab, consider the following scenario: You work as an Azure Security Engineer for The Pupper Camp (TPC). TPC is a dog services company with offices across the globe. Microsoft recommends using a user delegation SAS when possible, so your manager has asked you to test the functionality of a user delegation SAS and demonstrate how to create and revoke access to a blob object in an Azure storage account. This is part of a proof of concept that TPC is developing, which will eventually be configured using an Entra ID Service Principal.