Forum Discussion
Azure Maps visual with URL access
Hi Anonymous ,
Please refer below sample valid SAS token URL structure for Azure Blob Storage that should work with Azure Maps in Power BI.
https://<storage-account>.blob.core.windows.net/<container>/<file>.geojson?
sv=2022-11-02
&st=2025-09-05T12:00:00Z
&se=2025-09-05T20:00:00Z
&sr=b
&sp=r
&sig=AbCdEfGhIjKlMnOpQrStUvWxYz1234567890%2Fabcdefg%3D
sv --> Storage service version (e.g 2022-11-02)
st --> Start time (UTC) when the SAS becomes valid
se --> Expiry time (UTC) when the SAS expires
sr --> Resource type (b for blob, c for container)
sp --> Permissions (r for read)
sig --> HMAC-SHA256 signature generated using the storage account keyNote: Check the URL is accessed over HTTPS, and the blob is not set to public access if you are relying solely on the SAS token for security.
Please try below additional Security things.1. Use User Delegation SAS, It is more secure than account-level SAS. Tied to Azure AD identities. Requires role assignment for Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey.
2. Use the sip parameter to restrict access to specific IP ranges.
3. Use spr=https to enforce HTTPS-only access.
Please refer below sample SAS Token URL Structure with all security parameters.https://mysecurestorage.blob.core.windows.net/mapsdata/india.geojson?
sv=2022-11-02
&st=2025-09-05T12:00:00Z
&se=2025-09-05T14:00:00Z
&sr=b
&sp=r
&sip=203.0.113.0-203.0.113.255
&spr=https
&sig=AbCdEfGhIjKlMnOpQrStUvWxYz1234567890%2Fabcdefg%3DPlease refer below Microsoft official documents.
Service SAS examples - Azure Storage | Microsoft Learn
Grant limited access to data with shared access signatures (SAS) - Azure Storage | Microsoft Learn
I hope this information helps. Please do let us know if you have any further queries.
Regards,
Dinesh
Hi Anonymous ,
Thank you for reaching out to the Microsoft Community Forum.
SAS Token with Azure Maps Reference Layer in Power BI.
1. Enable URL-based Reference Layer, In Power BI, go to the Azure Maps visual. Under the Format pane, expand Reference Layer. Choose URL as the type and paste the full URL to your GeoJSON file hosted in Azure Blob Storage.
2. Please refer sample URL.
https://<storage-account>.blob.core.windows.net/<container>/<file>.geojson?<sas-token>
Note: Check the SAS token includes read-only permissions and is short-lived.
Please try below things for Securing SAS Token Access.
1. Never share SAS URLs over HTTP. Use HTTPS to prevent man-in-the-middle attacks.
2. Only grant read access. Avoid write/delete unless absolutely necessary.
3. Set the SAS token to expire in minutes or hours, not days.
4. Don’t embed SAS tokens in reports or code. Use secure vaults or dynamic generation.
5. Store SAS tokens securely in Azure Key Vault and retrieve them programmatically when needed.
6. Enable Azure Monitor or Storage Analytics logs to track SAS token usage and detect anomalies.
7. Use User Delegation SAS, these are more secure as they are tied to Azure active directory identities and don’t require storage account keys.
8. Long expiry tokens increases risk. Use stored access policies for better control.
Please refer below Microsoft articles.
Authentication best practices in Azure Maps - Microsoft Azure Maps | Microsoft Learn
How to secure an Azure Maps application with a SAS token - Azure Maps | Microsoft Learn
How do I use SAS tokens to read files from an Azure Blob Storage container? - Microsoft Q&A
I hope this information helps. Please do let us know if you have any further queries.
Regards,
Dinesh
Hi Anonymous ,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. And, if you have any further query do let us know.
Regards,
Dinesh