If you want policy-based revocation, use service SAS and plan around the five-policy cap per container. For user delegation SAS, know that the kill switch is the Entra identity, not a policy.

Context: Stored access policies let you revoke a whole set of SAS tokens by deleting the policy, but they only work with service SAS tokens. Account SAS and user delegation SAS do not support them, and each container caps out at five policies. If you are on a user delegation SAS, revocation means revoking the Microsoft Entra credentials behind the delegation key instead.