Direct links with SAS tokens

[gtaglang-scor]

Problem

Currently, users cannot easily download blobs in Azure Storage Explorer using a SAS URI. This forces us to either grant account-level permissions or build custom download solutions. We need a way for users to download large files directly in Storage Explorer without requiring access to the storage account.

Desired Solution

• The storage explorer protocol should support SAS tokens.
• A user should be able to click a link containing a SAS token and open/download the blob in Storage Explorer without signing in or having account-level permissions.
• The link does not need to be generated from within the Azure Storage Explorer.

Alternatives and Workarounds

• Download the file through a web app.
• Grant users permissions to the storage account (undesirable for security and governance reasons).

Additional Context

We have large files that users need to download using Storage Explorer for reliability and resumable transfers. However, granting each user permissions to the storage account is not acceptable. SAS tokens provide a secure, time-limited way to share access, but Storage Explorer currently does not support this workflow.

[craxal]

@gtaglang-scor You say users have a blob SAS URI. Can users paste the blob URL into a web browser and download that way? Alternatively, can they use AzCopy to download the blob?

Direct links are meant to be easy ways to open resources that appear in the explorer tree (subscriptions, storage accounts, storage services). Service and container level resources fit this description. Object resources such as blobs do not.