how to change the experation date of the SAS Keys

Question

how to change the experation date of the SAS Keys

John Fabiani 25

Change the experation date of the SAS Keys. As the keys have expired.

kagiyama yutaka 5,330 Reputation points

2026-07-26T04:57:39.8666667+00:00

Could you add a bit more detail? specifically the SAS type you’re using and whether it was created with a Stored Access Policy? These two points change how the expiration can be updated.

1 answer

Your answer

kagiyama yutaka 5,330 Reputation points

2026-07-26T04:57:39.8666667+00:00

Could you add a bit more detail? specifically the SAS type you’re using and whether it was created with a Stored Access Policy? These two points change how the expiration can be updated.

Answer 1

For Azure Storage SAS, the expiration date of an existing SAS token cannot be changed. The expiry is built into the token when it is created.

If the SAS has already expired, the supported options are:

Generate a new SAS token with a new expiry time.
If the SAS is tied to a stored access policy, change the policy expiry or recreate the SAS against that policy.
If the SAS is an ad hoc SAS with no stored access policy, the only way to replace it is to issue a new SAS.

To control SAS expiry for future tokens at the storage account level, configure a SAS expiration policy:

Azure portal

Open the storage account.
Go to Settings > Configuration.
Enable Shared access signature (SAS) expiration policy.
Set Upper limit for SAS expiry interval.
Optionally set the action to Log or Block.
Select Save.

Important notes

If the setting is grayed out, rotate both account access keys first.
A user delegation SAS has a maximum expiry interval of 7 days.
Azure File Sync requires the upper limit to be 3 days or greater.
If the storage account key creation time is null, rotate the account access keys before configuring the policy.

If the goal is to immediately invalidate old SAS tokens, regenerating the account key used to sign them revokes them. This affects all applications using that key until they are updated, so this is a disruptive change.