Blob SAS Link Generation and Expiry

Overview

This flow delivers governed, auditable, time-limited access to Azure Blob Storage files. On each pass it issues scoped, expiring SAS (Shared Access Signature) links for pending requests logged in a Dataverse table, records who requested what and when it expires, emails the secure link to the requester, then expires and reports links that have passed their validity window. The storage signing key stays in Azure Key Vault and is never written into a link, email, or log.

Why it matters: ad-hoc sharing of blob files via long-lived links is risky. Scoped, read-only, HTTPS-only SAS links with a hard expiry and a full audit trail keep file sharing safe and reviewable.

Ships Off (demo).

Use Case

A user needs to share a single file from a governed container temporarily, without exposing the whole container or handing out a permanent link. They (or an intake form/Teams/HTTP front end) drop a row into the SAS Request table with the blob path, their email, and the desired duration; the flow mints a scoped link capped to the maximum window, delivers it, and guarantees it self-expires and is marked Expired in the audit log.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

On-demand issuance

Replace the Recurrence with a Forms/Teams/HTTP trigger that creates the Requested row for instant delivery.

Tighter permissions

The link uses Read + HttpsOnly; add policy/IpAddressOrRange to bind the SAS to a corporate IP range.

Shorter ceilings

Lower flowlibs_MaxSasHours to enforce a stricter maximum window.

Approval gate

Insert an Approvals step before issuance for sensitive files or containers.

Per-container routing

Drive the governed container (or a per-row container column) to govern multiple containers from one flow.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

addHours(utcNow(), min(int(coalesce(items()?['flowlibs_requestedhours'], variables('varMaxSasHours'))), int(variables('varMaxSasHours'))))

concat('/', variables('varGovernedContainer'), '/', items()?['flowlibs_blobpath'])

flowlibs_status eq 'Issued' and flowlibs_expiryon lt @{utcNow()}

body('Generate_SAS_Link')?['WebUrl']