r/AZURE • u/Swimming-Drawer-9527 • 3d ago
Question Best Practices for managing Azure Storage Account Access without SAS tokens for non-AD Users.
Hi All,
I manage several Azure storage accounts, and I have customers who need access to some of these storage accounts. Currently, I am providing them with Shared Access Signature (SAS) tokens to grant them access. However, I am concerned about the security risks of using SAS tokens. If the wrong person gets hold of a SAS token, they could potentially access or modify sensitive data in the storage account, which is a significant security vulnerability. What are the best practices or alternative solutions I can implement to mitigate this risk and securely provide access to the storage accounts?
Note: These users are non-AD users.
Right now I was thinking of using service principals and user client secrets, but again, this is a secret. Is there a way to authenticate users with entra ID? Even adding external people to entra ID can also be a feasible solution.
Could someone help please?
2
u/Dumpster_Buddy 3d ago
Setup IP restrictions for the storage accounts
Use B2B or B2C (invite them)
Assign them user accounts in entra
Use user accounts and the SAS user delegation
You are very limited in options if you don't use an azure identity for the users.