Cascade's automation team is building a script that needs one single credential granting read and write access across both the Blob service and the File service in a storage account, rather than being scoped to one container or one service. Which SAS type is designed to span multiple storage services in a single token?

An account SAS operates at the storage account level and can be configured to authorize operations across multiple services — including Blob and File together — in a single token, which directly matches the automation script's need to touch both without juggling separate credentials. A user delegation SAS is secured with Microsoft Entra ID credentials and offers strong identity-based revocation, but it is scoped to the Blob service (and Data Lake Storage) and does not extend to the File service, so it can't satisfy a requirement spanning both. A service SAS scoped to a single container is deliberately narrow by design — useful for restricting access tightly, but the opposite of what's needed when the script must reach across two different services rather than one container. A stored access policy is not itself a bearer credential; it's a server-side definition that a SAS references to inherit permissions and expiry, so it can't be used on its own in place of an actual SAS token. A caveat: because an account SAS is broader by nature, it should still be scoped as tightly as possible on permissions, allowed services, and expiry to avoid granting more than the automation genuinely needs. To confirm the token works as intended, test it against both a blob operation and a file-share operation and verify both succeed while an unrelated service, such as queues, is denied if it wasn't included.