How Do You Warn Users When a SAS Exceeds Seven Days?

Why the Answer Is Correct

Azure Storage lets a storage account owner publish a SAS expiration policy under the account's Configuration blade, in the Shared access signature (SAS) settings section. Within that policy you set a maximum expiry interval (for example seven days) and then choose whether the recommended upper limit is Disabled, Enabled or Required. With Allow recommended upper limit for shared access signature (SAS) expiry interval set to Enabled, the policy is advisory: a user who generates a SAS whose expiry exceeds the documented interval still succeeds, but immediately receives a warning explaining that the SAS lasts longer than the recommended limit. That is exactly the behaviour the question asks for — "users receive a warning message when they generate a SAS that exceeds a seven-day time period." Setting the value to Required would be stricter: it would block generation of any SAS beyond the limit rather than warn, so Enabled is the precise fit here. This is a storage-account-level configuration, so it is applied once on the storage account and covers all SAS types generated for that account (service, account and user delegation SAS).

Why the Other Options Are Wrong

A. Enable a read-only lock. A CanNotDelete/read-only management lock only prevents modification or deletion of the storage account resource in Azure Resource Manager. It has no visibility into SAS token generation and cannot emit any message to the user creating a signature. B. Configure an alert rule. An Azure Monitor alert rule evaluates metrics, activity-log events or log queries and notifies configured action groups when a threshold is breached. It is a monitoring/notification construct, not an interactive warning at SAS-creation time, and there is no metric that would reproduce the built-in policy warning. C. Add a lifecycle management rule. Lifecycle management rules move or delete blobs in a storage account (for example, tiering to Cool or deleting blobs older than N days). They govern blob data retention and have nothing to do with the lifetime of a SAS token.

Community Comment Notes

Shakka walked through the exact portal path, describing navigation to the storage account and then to Configuration where you find the SAS expiration policy and set the recommended upper limit, which matches the documented procedure. sca88 posted the Microsoft Learn article on the SAS expiration policy, confirming that the vendor documentation is the authoritative source for this scenario. KAM2023 and Sweden2022 both recorded straightforward confirmations that D is correct, and no commenter proposed a competing option, so the community consensus (100% for D) aligns with the official behaviour.