Check SAS authentication before relying on a subscription-based perimeter access rule

Source facts

Microsoft documents that intra-perimeter traffic and subscription-based inbound access rules do not support authentication using a shared access signature token. Requests using SAS in those scenarios are rejected with an authentication error. The guidance calls for an alternative authentication method supported by the particular resource. Microsoft Learn.

Applicability

Use this review for an application moving into the specified Network Security Perimeter access pattern. Identify the actual request credentials, target resource, perimeter mode and inbound rule type. Check that resource’s current perimeter support and limitations before changing its network boundary.

DSE recommendation

DSE recommends asking the application owner to demonstrate the authentication method actually used by the workload. If it uses SAS in the documented excluded scenario, plan and validate an appropriate supported method with the resource owner. Keep credential migration separate from broadening network access, and preserve the original configuration for an approved recovery path.

Verification

Exercise a representative request through the intended rule and record the authentication method and outcome without exposing the token. Correlate resource and perimeter observations. After an approved authentication change, repeat the same operation and confirm the expected access boundary still applies. Do not remove a required network restriction merely because the rejected request surfaced as an authentication error.

Official references

Microsoft Learn: What is a network security perimeter?.