Generally Available: Prefix-scoped access for User Delegation SAS
Share
Services
Support for prefix-scoped access for User Delegation SAS for Azure Blob Storage is generally available in all Azure regions. SAS tokens for Blob Storage have historically supported two levels of scope: container and individual blob. With this release, you can now scope access to a prefix or virtual directory within a container, granting access to all blobs beneath the path.
This is especially valuable for applications that organize data by tenant, workspace, project, or department within a shared container. Instead of granting access to an entire container or generating many blob-level tokens, you can now issue a single SAS token scoped to a set of blobs through a prefix.
Prefix-scoped access is supported for both Blob and Data Lake storage accounts.
Learn more:
* [Prefix Scoped Access for User Delegation SAS Blog](https://techcommunity.microsoft.com/blog/AzureStorageBlog/prefix-scoped-access-for-user-delegation-sas-is-now-generally-available-for-azur/4516010)
* [Create a user delegation SAS documentation](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)