Generated Storage level SAS token using Logic Apps not working as expected

@Varun Reddy Gurram ,

Could you confirm if the storage account is enabled with Hierarchical Namespace (HNS) for Data Lake Storage Gen2, verify if other API versions (like 2020-10-02) were tested, and clarify whether you're using the REST API, SDK, or another method to access the dfs.core.windows.net endpoint, as well as the specific operations you're attempting with the SAS token?

Hi Khadeer, Yes Hierarchical Namespace (HNS) for Data Lake Storage Gen2 is enabled on storage account. Yes tried with different API versions. Using Rest API method to access dis.core.windows.net endpoint.

All I am trying to do is put the entire generated url in postman, it just lists everything in storage account.

When the same is generated manually using Azure UI with same permissions it works with dfs. and also works fine in postman and lists everything.

Hi Varun Reddy Gurram

It looks like the (List Account SAS Rest API) takes an in-built signed version of 2015-04-05.

Alternatively, you can use the Powershell script below to manually create a SAS token with signedVersion = "2024-11-04", as shown in the portal.

Script:

# Current UTC time and expiry
$xMsDate = [System.DateTime]::UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ")
$expiryInSeconds = 7200 # 2 hours validity

# SAS Parameters
$accountName = "venkat8912"
$signedPermissions = "rwdlacup"
$signedService = "bfqt"
$signedResourceType = "sco"
$signedStart = $xMsDate
$signedExpiry = [System.DateTime]::UtcNow.AddSeconds($expiryInSeconds).ToString("yyyy-MM-ddTHH:mm:ssZ")
$signedIP = "" # Optional
$signedProtocol = "https"
$signedVersion = "2024-11-04"
$signedEncryptionScope = "" # Optional

# Replace with your actual Storage Account key
$accessKey = "xxxxx="

# Construct String-to-Sign
$StringToSign = "{0}`n{1}`n{2}`n{3}`n{4}`n{5}`n{6}`n{7}`n{8}`n{9}`n" -f `
    $accountName, $signedPermissions, $signedService, $signedResourceType, `
    $signedStart, $signedExpiry, $signedIP, $signedProtocol, $signedVersion, $signedEncryptionScope

# Convert access key and StringToSign to byte arrays
$keyBytes = [Convert]::FromBase64String($accessKey)
$signatureBytes = [System.Text.Encoding]::UTF8.GetBytes($StringToSign)

# Generate HMAC-SHA256 signature
$hasher = New-Object System.Security.Cryptography.HMACSHA256
$hasher.Key = $keyBytes
$signature = [Convert]::ToBase64String($hasher.ComputeHash($signatureBytes))

# Build SAS token with URL-encoded signature
$encodedSignature = [System.Net.WebUtility]::UrlEncode($signature)

$sasToken = "sv=$signedVersion&ss=$signedService&srt=$signedResourceType&sp=$signedPermissions&se=$signedExpiry&st=$signedStart&spr=$signedProtocol&sig=$encodedSignature"

# Output the SAS Token
Write-Output $sasToken

Output:

sv=2024-11-04&ss=bfqt&srt=sco&sp=rwdlacup&se=2025-05-02T14:02:21Z&st=2025-05-02T12:02:21Z&spr=https&sig=u4xo5%xxxxxxxrPDLka1qo%3D

To verify the SAS token, I used the DFS endpoint with the file name and pasted it into the browser.

Browser:

If you want to run the above PowerShell script using logic apps , you can leverage run PowerShell code action in standard logic apps which is in preview refer to this documentation for more information.

Also make sure you have this app setting "FUNCTIONS_EXTENSION_VERSION" value to '4.837.1.23604'.

If this resolves your issue, please click “up-vote" for it, which could help other community members who read this thread. And, if you have any more questions, please let us know.