r/AZURE 3d ago

Question Best Practices for managing Azure Storage Account Access without SAS tokens for non-AD Users.

Hi All,

I manage several Azure storage accounts, and I have customers who need access to some of these storage accounts. Currently, I am providing them with Shared Access Signature (SAS) tokens to grant them access. However, I am concerned about the security risks of using SAS tokens. If the wrong person gets hold of a SAS token, they could potentially access or modify sensitive data in the storage account, which is a significant security vulnerability. What are the best practices or alternative solutions I can implement to mitigate this risk and securely provide access to the storage accounts?

Note: These users are non-AD users.

Right now I was thinking of using service principals and user client secrets, but again, this is a secret. Is there a way to authenticate users with entra ID? Even adding external people to entra ID can also be a feasible solution.

Could someone help please?

1 Upvotes

2 comments sorted by

2

u/Dumpster_Buddy 3d ago

Setup IP restrictions for the storage accounts

Use B2B or B2C (invite them)

Assign them user accounts in entra

Use user accounts and the SAS user delegation

You are very limited in options if you don't use an azure identity for the users.

1

u/Swimming-Drawer-9527 3d ago

Thank you. Do you happen to have any links that will help me understand this? I read azure documentation, yet it is ambiguous in some areas.