Access Key vs. Shared Access Signature (SAS) Token

Files.com can connect to Azure Blob Storage using a storage account access key or a Shared Access Signature (SAS) token. An access key grants broad storage account access. A SAS token limits the resources, operations, and validity period available to anyone holding it; it is not inherently tied to a particular Files.com user.

Use a token scoped to the resources and operations the integration needs. Protect either credential as a secret. Follow Azure's SAS guidance when choosing its lifetime and permissions.

Credential Rotation

Files.com uses the key or token saved on the Remote Server. Replace a SAS token before it expires, and update the Remote Server before revoking an old access key. A SAS token does not refresh itself. Choose an expiration period your organization can support with a reliable rotation process.

An expired or revoked credential causes dependent Mounts, Syncs, automations, and transfers to fail until you replace it. Review failed or partially completed runs after restoring access; some files may already have transferred. Do not wait for an expiry-related outage to rotate the credential.

SAS Token Permissions

A SAS Token carries only the permissions you grant when you create it, so the token must include every permission Files.com needs for the operations you intend to perform. An access key grants broad storage account access and cannot be narrowed. Use a SAS token when the integration needs a restricted scope.

Scope a SAS token to the storage the integration needs. An account SAS can cover the storage account; a service or user-delegation SAS can cover a container. Directory-scoped SAS tokens apply to accounts with hierarchical namespace enabled and require the corresponding directory scope and depth. A narrower scope reduces the data the connection can reach.

An account SAS and a service SAS are signed with the storage account key. A user-delegation SAS is signed with a user delegation key obtained through Microsoft Entra ID. A user delegation SAS is limited by the permissions of the Microsoft Entra identity that obtained the delegation key as well as the token's permissions. Its lifetime cannot exceed that of the delegation key, which is at most seven days. Account-key-signed tokens have different authorization and revocation rules. Choose a supported scope and signing method together with a rotation process.

When you create an account SAS, set Allowed services to Blob and Allowed resource types to both Container and Object. If any of the three is missing, Azure rejects operations with a service or resource-type mismatch error. A container-scoped service or user-delegation SAS expresses its scope in the token rather than through those account-SAS settings.

Grant one of the following permission sets based on how Files.com will use the container.

Full Access

Full access lets Files.com perform create, read, update, and delete operations on the container, including renaming, moving, and copying files and folders. Use it when Files.com both uploads and downloads, synchronizes folders, or manages data through Syncs and automations.

Grant Read, Write, Delete, and List, which appear on the token as sp=rwdl. These permissions cover the flat-namespace file operations, including copy-and-delete moves. The Create permission that the Azure portal also offers is not required, because the Write permission already covers adding new files.

For a container with hierarchical namespace, include Move permission when the connection performs native file renames. A service or user-delegation SAS then needs rwdlm for the read, write, delete, list, and move operations. Other Azure controls, including directory permissions for user-delegation access, can also affect authorization.

Read-Only Access

Read-only access lets Files.com list and download files without changing anything in the container. Use it when Files.com imports data or provides read access to files but must not upload, overwrite, or delete.

Grant Read and List, which appear on the token as sp=rl.

When you scope the token to read-only, also set the Files.com users with access to this container to read-only folder permissions, so that the storage-side scope and the Files.com-side permissions match.

Write-Only Access

Write-only access is a drop-off mode. Files.com uploads files into the container but cannot download, rename, move, copy, or delete them. Use it for one-way delivery that does not require reading files back. Write permission can also overwrite an existing blob, so this permission set alone does not enforce immutability.

Grant Write and List, which appear on the token as sp=wl. The Write permission lets Files.com upload files. The List permission is required as well, because Files.com lists the uploaded file afterwards to confirm it was written correctly, and without List that confirmation fails with an authorization error.

Azure RBAC and SAS Permissions

For account-key-signed SAS tokens and direct access keys, Microsoft Entra RBAC assignments do not narrow the key's data access. A user delegation SAS is different: access is limited by both the token and the issuing identity's permissions. Configure the token permissions and any applicable identity permissions together.