Access Azure Storage from GitHub Actions with a Managed Identity
In this tutorial, we will use OpenID Connect (OIDC) to authenticate GitHub Actions to an Azure Storage Account without storing long-lived client secrets. By establishing a federated credential, GitHub dynamically requests short-lived access tokens from Microsoft Entra ID by proving the workflow originates from a trusted repository, branch, or environment.
Use AzCopy with a SAS token to copy data across Azure tenants
A few days ago I had to copy blobs from a storage account in one Azure tenant to another storage account in a different tenant. As a pragmatic approach for this task I used azcopy together with a SAS token.
SAS stands for Shared Access Signature, in simple terms, it is a temporary URL with limited permissions, so you can grant access to a storage resource without exposing the full account key. Using SAS can be useful when you just want to move data from one tenant to another without setting up a full identity and RBAC model for the job.