--- title: "Generate Azure SAS Tokens with PowerShell and Portal" description: "Create Azure SAS tokens using PowerShell and Azure portal for secure storage management. Boost your cloud security and authentication skills." canonical: "https://adamtheautomator.com/azure-sas-token/" --- # Generate Azure SAS Tokens with PowerShell and Portal > Create Azure SAS tokens using PowerShell and Azure portal for secure storage management. Boost your cloud security and authentication skills. Source: https://adamtheautomator.com/azure-sas-token/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Generate Azure SAS Tokens with PowerShell and Portal](https://adamtheautomator.com/wp-content/uploads/2019/12/office-515984_1920.jpg) # Generate Azure SAS Tokens with PowerShell and Portal [![](https://secure.gravatar.com/avatar/9a14f10ff1b1ec7d790d34f5b559e4d3de2d31b172e6ef266dfd8b479174d97b?s=192&d=mm&r=g)June Castillote](https://adamtheautomator.com/author/june/)19 December 20193 min. read Categories: [Cloud](/category/cloud/) Tags:[Microsoft Azure](/tag/microsoft-azure/) Table of Contents * [Prerequisites](#prerequisites) * [Generating a SAS Token using the Azure Portal](#generating-a-sas-token-using-the-azure-portal) * [Generating a SAS Token using PowerShell](#generating-a-sas-token-using-powershell) * [Limiting SAS Token Permissions](#limiting-sas-token-permissions) * [Using the SAS Token](#using-the-sas-token) * [Summary](#summary) There are a few different ways you can delegate access to resources in Azure. One way is via a _[Shared Access Signature (SAS)](https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview)_ token. A SAS token is a way to granularly control how a client can access Azure data. You can control many things such as what resources the client can access, what permission the client has, how long the token is valid for and more. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** One common use of SAS token is to secure Azure storage accounts through the use of an [account SAS](https://docs.microsoft.com/en-us/rest/api/storageservices/create-account-sas). In this article, you’re going to learn how to create an Azure SAS token both via the Azure portal and via PowerShell. By the time you’re done, you’ll have a SAS token to then pass to various client commands to authenticate and authorize Azure storage management. ## Prerequisites You’ll learn hands-on how to perform a few different tasks in this article. If you’d like to follow along, be sure you have the following prerequisites met. * An Azure subscription. If you do not have this yet, you can [request for a trial subscription](https://azure.microsoft.com/en-us/free/). * Azure Storage Account. Please refer to [Create a storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-quickstart-create-account?tabs=azure-portal) to learn more. * The [Az PowerShell](https://docs.microsoft.com/en-us/powershell/azure/install-az-ps) module (optional). This is required only if you will generate Shared Access Signature tokens using PowerShell * Windows PowerShell 5.1 or PowerShell Core 6+ if generating a SAS token via PowerShell ## Generating a SAS Token using the Azure Portal The most straightforward way to generate a SAS token is using the [Azure Portal](https://portal.azure.com). By using the Azure portal, you can navigate the various options graphically. To create a token via the Azure portal, first, navigate to the storage account you’d like to access under the _Settings_ section then click _Shared access signature_. You can see an example of what this might look like below. There are many permissions you can grant SAS tokens and start/end times. For this article, you’re going to assign full permissions and leave the default expiration time of eight hours. If you’d like a breakdown and explanation of each permission, check out the [Microsoft docs](https://docs.microsoft.com/en-us/rest/api/storageservices/create-account-sas). Leave all of the default checkboxes and click the _Generate SAS and connection string_ button as shown below. ![Generating SAS Token from the Azure Portal](https://adamtheautomator.com/wp-content/uploads/2020/06/Untitled-93.png) Generating SAS Token from the Azure Portal Once the token is generated, you will see it listed in the boxes below the _Generate SAS and connection string_ button as shown below. ![Copying the generated SAS token](https://adamtheautomator.com/wp-content/uploads/2020/06/Untitled-94.png) Copying the generated SAS token At this point, you can copy the SAS token and paste its value wherever you need to use it. ## Generating a SAS Token using PowerShell To prevent having to log into the Azure portal or, perhaps, if you’re generating SAS tokens for many storage accounts at once, you can use PowerShell. PowerShell uses Azure’s REST API to make calls to Azure to generate the token. To [create a SAS token via PowerShell](https://adamtheautomator.com/azure-sas-token/), first, open up a PowerShell console and authenticate with Connect-AzAccount. Once authenticated, then find the storage account you’d like to access. Below you can see an example of querying a storage account called _demo\_account_ in the _demo\_rg_ resource group. Using the value of `$context`, you’ll then pass this to the token-generation command. ```powershell $context = (Get-AzStorageAccount -ResourceGroupName 'demo_rg' -AccountName 'demo_account').context ``` Once the storage account context is found, then create a SAS token using the `New-AzStorageAccountSASToken` command. The below example shows generating a SAS token giving full permission to the storage account and all subcomponents. ```powershell New-AzStorageAccountSASToken -Context $context -Service Blob,File,Table,Queue -ResourceType Service,Container,Object -Permission racwdlup ``` > _When creating SAS tokens via `New-AzStorageAccountSASToken`, the token will be valid for one hour. If you’d like to extend this time, you can use the `ExpiryTime` parameter._ ### Limiting SAS Token Permissions One reason to use a SAS token is giving access to other parties for a limited time and set of permissions. The previous example generated a SAS token with full access permissions. Giving full access is not always the best-case scenario. The `Service` parameter defines access to a service or services. For example, use `blob` to allow access only to the _[Azure Blob Storage service](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction)_. Other services include _[File](https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction)_, _[Table](https://docs.microsoft.com/en-us/azure/storage/tables/table-storage-overview), and [Queue](https://docs.microsoft.com/en-us/azure/storage/queues/storage-queues-introduction)._ The `ResourceType` parameter limits access to specific types of resources. Using the `container` as a value, for example, permits access to container resources only. Other valid resource types _Service_ and _Object_. The `Permission` parameter allows you to define allowed permissions. Specify one or more permissions as needed. The value of `rwd` is equal to giving _read_, _write_ and _delete_ permissions. Other valid permission values are _(l)ist_, _(a)dd_, _(u)pdate_, and _(p)rocess._ ## Using the SAS Token There are many ways to use the SAS token generated. One of the most common ways is to use it in a [storage context](https://docs.microsoft.com/en-us/powershell/module/azure.storage/new-azurestoragecontext). A storage context is a way you can “package” up credentials to then pass to various commands. A common way to use the SAS token is via PowerShell. Using the `New-AzStorageContext` command that’s part of the Az [PowerShell module](https://adamtheautomator.com/powershell-modules/ "PowerShell module"). You can see an example below using the SAS token to upload a file to an existing storage container. ```powershell $StorageAccountName = 'foo' $ContainerName = 'bar' Create a storage context $sasToken = '' $StorageContext = New-AzStorageContext $StorageAccountName -SasToken $sasToken Upload a file $storageContainer = Get-AzStorageContainer -Name $ContainerName -Context $StorageContext $storageContainer | Set-AzStorageBlobContent –File 'C:\file.txt' –Blob 'file.txt' ``` ## Summary Creating a SAS token can be done a few different ways. In this article, you learned a couple of the most common ways. Once created, a SAS token can be used in many different ways but deciding that way is up to you. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-sas-token%2F&text=Generate%20Azure%20SAS%20Tokens%20with%20PowerShell%20and%20Portal)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fazure-sas-token%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-sas-token%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-1.webp) ### [Microsoft Azure Certification Roadmap: Choose the Right Path](/azure-certification-roadmap-2/) Choose the right Microsoft Azure certification for your career goals. Compare AZ-900, AZ-104, AZ-305, AZ-400, AZ-700, DP-700, study timelines, and 2026 retirements. ![](https://adamtheautomator.com/wp-content/uploads/2021/05/How-to-RenameMove-Azure-Resource-Groups-GUI-and-CLI.jpg) ### [Smart Ways to Rename Azure Resource Groups (GUI and CLI)](/rename-azure-resource-group/) Unlock the secret to Rename Azure Resource Groups! Dive into our easy guide for reshaping your Azure landscape with Portal, PowerShell, and CLI techniques. ![](https://adamtheautomator.com/wp-content/uploads/2021/03/azure-cli.jpg) ### [Master Azure CLI: Command Your Cloud with Confidence](/azure-cli/) Unlock the full potential of cloud management with the Azure CLI. This guide provides the essentials to get you started with Azure resources efficiently. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)