Expire Shared Access Signature Tokens

01 Sign in to Azure Management Console.

02 Navigate to Azure Storage accounts blade at https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Storage%2FStorageAccounts.

03 Click on the name of the storage account that holds the SAS token that you want to regenerate.

04 In the navigation panel, under Settings, choose Shared access signature.

05 On the Shared access signature page, perform the following actions to generate your new SAS token:

1. From Allowed services, select the Azure Storage services accessible with the account SAS.
2. From the Allowed resource types section, select the storage resource types accessible with the account SAS.
3. From Allowed permissions, choose the permissions required for the account SAS. Permissions are valid only if they match the specified allowed resource type, otherwise, they are ignored.
4. Use the Start and End date and time picker controls from the Start and expiry date/time section to configure the start and the end date/time during which the account SAS is valid. Make sure that the SAS validity period configured at this step is no longer that an hour.
5. In the Allowed IP addresses box, enter the client IP address or range of IP addresses from which to accept requests.
6. From Allowed protocols, choose the protocols permitted for requests made with the account SAS. We strongly recommend allowing requests over HTTPS only.
7. From Signing key, select the access key used to authenticate the requests. Note that if you regenerate the selected access key, the existing SAS token will also need to be regenerated. This action will not interrupt access to disks from your Azure virtual machines (VMs).
8. Click Generate SAS and connection string to create your new Azure Shared Access Signature (SAS).

06 Replace the Shared Access Signature (SAS) token defined within the SAS URL(s) provided to your storage account clients with the compliant token generated at the previous step (e.g. ?sv=2018-03-28&ss=bfqt&srt=sco&sp=rwdlacup&se=2019-06-11T12:33:50Z&st=2019-06-11T13:33:50Z&spr=https&sig=aaaabbbbccccddddaaaabbbbccccddddaaaabbbbccccdddd), available in the SAS token box.

07 If required, repeat step no. 5 and 6 to generate new Shared Access Signature (SAS) tokens.

08 Repeat steps no. 3 – 7 for each storage account available in the current Azure subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

01 First, configure the Shared Access Signature (SAS) validity period (in this case 1 hour):

end=`date -d "60 minutes" '+%Y-%m-%dT%H:%MZ'`

02 Next, run storage account generate-sas command (Windows/macOS/Linux) using the name of the storage account that holds the non-compliant SAS token as identifier parameter, to generate a new Shared Access Signature (SAS) for Blob, File, Queue and Table Azure Storage services on Linux, with a validity period of one hour:

az storage account generate-sas
	--permissions cdlruwap
	--account-name abcd1234abcd1234abcd1234
	--services bfqt
	--resource-types sco
	--expiry $end -otsv

03 The command output should return the new Shared Access Signature (SAS) parameters, e.g.:

se=2019-06-11T17%3A23Z&sp=rwdlacup&sv=2018-03-28&ss=qt&srt=sco&sig=abcdabc/abcd1234abcd%1234abcd1234abcd1234abcd%1234

04 If required, repeat steps no. 1 – 3 to generate new Shared Access Signature (SAS) tokens.

05 Repeat steps no. 1 – 4 for each storage account available in the current Azure subscription.

06 Repeat steps no. 1 – 5 for each subscription created in your Microsoft Azure cloud account.