A service SAS is secured with the storage account key. A service SAS delegates access to a resource in only one of the Azure Storage services: Blob storage, Queue storage, Table storage, or Azure Files. Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview