# Authenticate with Azure Blob Storage using SAS tokens

> AzureBlobConfig now supports Shared Access Signature (SAS) token authentication as an alternative to connection strings and service principal credentials.

- Published: 2026-04-02
- Author: Ashpreet Bedi
- Categories: Changelog
- Canonical: https://www.agno.com/blog/authenticate-with-azure-blob-storage-using-sas-tokens
- Markdown: https://www.agno.com/blog/authenticate-with-azure-blob-storage-using-sas-tokens.md

`AzureBlobConfig` now supports Shared Access Signature (SAS) token authentication as an alternative to connection strings and service principal credentials. This makes it easier to grant time-scoped, permission-limited access to Azure Blob Storage without exposing full account credentials, which is useful for automated pipelines, temporary access grants, and least-privilege storage configurations.

```python
# Clone and setup repo
git clone https://github.com/agno-agi/agno.git
cd agno/cookbook/07_knowledge/cloud

# Create and activate virtual environment
./scripts/demo_setup.sh
source .venvs/demo/bin/activate

# Optiona: Run PgVector (needs docker)
./cookbook/scripts/run_pgvector.sh

python azure_blob.py
```

Details**:**

- Pass a SAS token directly to `AzureBlobConfig` alongside the account URL
- Complements existing authentication paths; no migration required for configurations already using connection strings or service principal auth

See the [Azure Blob Storage Content Source for Knowledge docs](https://docs.agno.com/examples/knowledge/cloud/azure-blob#azure-blob-storage-content-source-for-knowledge) for more.