Azure · YanaXu · May 7, 2026 · Apr 1, 2026
diff --git a/src/Storage/Storage.Management.Test/Storage.Management.Test.csproj b/src/Storage/Storage.Management.Test/Storage.Management.Test.csproj
@@ -11,10 +11,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Azure.Storage.Blobs" Version="12.27.0-beta.1" />
-    <PackageReference Include="Azure.Storage.Files.DataLake" Version="12.25.0-beta.1" />
-    <PackageReference Include="Azure.Storage.Files.Shares" Version="12.25.0-beta.1" />
-    <PackageReference Include="Azure.Storage.Queues" Version="12.25.0-beta.1" />
+    <PackageReference Include="Azure.Storage.Blobs" Version="12.28.0-beta.1" />
+    <PackageReference Include="Azure.Storage.Files.DataLake" Version="12.26.0-beta.1" />
+    <PackageReference Include="Azure.Storage.Files.Shares" Version="12.26.0-beta.1" />
+    <PackageReference Include="Azure.Storage.Queues" Version="12.26.0-beta.1" />
   </ItemGroup>
 
   <ItemGroup>

diff --git a/src/Storage/Storage.Management/ChangeLog.md b/src/Storage/Storage.Management/ChangeLog.md
@@ -18,6 +18,13 @@
         - Additional information about change #1
 -->
 ## Upcoming Release
+* Supported cross tenant user delegation SAS token generation with OAuth-based storage contexts
+    - `New-AzStorageBlobSASToken`
+    - `New-AzStorageContainerSASToken`
+    - `New-AzDataLakeGen2SasToken`
+    - `New-AzStorageFileSASToken`
+    - `New-AzStorageShareSASToken`
+    - `New-AzStorageQueueSASToken`
 
 ## Version 9.6.1
 * Removed breaking change warnings for TLS 1.0 and TLS 1.1 deprecation

diff --git a/src/Storage/Storage.Management/help/New-AzDataLakeGen2SasToken.md b/src/Storage/Storage.Management/help/New-AzDataLakeGen2SasToken.md
@@ -15,17 +15,19 @@ Generates a SAS token for Azure DatalakeGen2 item.
 ### ReceiveManual (Default)
 ```
 New-AzDataLakeGen2SasToken [-FileSystem] <String> [-Path <String>] [-Permission <String>]
- [-DelegatedUserObjectId <String>] [-Protocol <SasProtocol>] [-IPAddressOrRange <String>]
- [-StartTime <DateTimeOffset>] [-ExpiryTime <DateTimeOffset>] [-EncryptionScope <String>] [-FullUri]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
+ [-DelegatedUserObjectId <String>] [-DelegatedUserTenantId <String>] [-Protocol <SasProtocol>]
+ [-IPAddressOrRange <String>] [-StartTime <DateTimeOffset>] [-ExpiryTime <DateTimeOffset>]
+ [-EncryptionScope <String>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
+ [<CommonParameters>]
 ```
 
 ### ItemPipeline
 ```
 New-AzDataLakeGen2SasToken -InputObject <AzureDataLakeGen2Item> [-Permission <String>]
- [-DelegatedUserObjectId <String>] [-Protocol <SasProtocol>] [-IPAddressOrRange <String>]
- [-StartTime <DateTimeOffset>] [-ExpiryTime <DateTimeOffset>] [-EncryptionScope <String>] [-FullUri]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
+ [-DelegatedUserObjectId <String>] [-DelegatedUserTenantId <String>] [-Protocol <SasProtocol>]
+ [-IPAddressOrRange <String>] [-StartTime <DateTimeOffset>] [-ExpiryTime <DateTimeOffset>]
+ [-EncryptionScope <String>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
+ [<CommonParameters>]
 ```
 
 ## DESCRIPTION
@@ -47,6 +49,14 @@ Get-AzDataLakeGen2Item -FileSystem test -Path "testdir/dir2" | New-AzDataLakeGen
 
 This example generates a DatalakeGen2 SAS token by pipeline a datalake gen2 item, and with specific StartTime, ExpireTime, Protocol, IPAddressOrRange, Encryption Scope.
 
+### Example 3: Generate a User Delegation SAS token with OAuth authentication context, and delegated user object ID and tenant ID
+```powershell
+$ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount
+New-AzDataLakeGen2SasToken -FileSystem "filesystem1" -Path "dir1/file.txt" -Permission rw -StartTime (Get-Date) -ExpiryTime (Get-Date).AddDays(6) -Context $ctx -DelegatedUserObjectId "00000000-0000-0000-0000-000000000000" -DelegatedUserTenantId "00000000-0000-0000-0000-000000000000"
+```
+
+This example generates a User Delegation DatalakeGen2 SAS token with OAuth authentication context, specifying the delegated user object ID and tenant ID for enhanced security.
+
 ## PARAMETERS
 
 ### -Context
@@ -94,6 +104,21 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -DelegatedUserTenantId
+Optional. The delegated user tenant id in Azure AD. This parameter can only be specified when input Storage Context is OAuth based.
+
+```yaml
+Type: System.String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -EncryptionScope
 Encryption scope to use when sending requests authorized with this SAS URI.
 

diff --git a/src/Storage/Storage.Management/help/New-AzStorageBlobSASToken.md b/src/Storage/Storage.Management/help/New-AzStorageBlobSASToken.md
@@ -16,37 +16,37 @@ Generates a SAS token for an Azure storage blob.
 ### BlobNameWithPermission (Default)
 ```
 New-AzStorageBlobSASToken [-Container] <String> [-Blob] <String> [-Permission <String>]
- [-DelegatedUserObjectId <String>] [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>]
- [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
- [<CommonParameters>]
+ [-DelegatedUserObjectId <String>] [-DelegatedUserTenantId <String>] [-Protocol <SharedAccessProtocol>]
+ [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
+ [-EncryptionScope <String>] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
+ [-Confirm] [<CommonParameters>]
 ```
 
 ### BlobPipelineWithPolicy
 ```
 New-AzStorageBlobSASToken -CloudBlob <CloudBlob> [-BlobBaseClient <BlobBaseClient>] -Policy <String>
- [-DelegatedUserObjectId <String>] [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>]
- [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
- [<CommonParameters>]
+ [-DelegatedUserObjectId <String>] [-DelegatedUserTenantId <String>] [-Protocol <SharedAccessProtocol>]
+ [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
+ [-EncryptionScope <String>] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
+ [-Confirm] [<CommonParameters>]
 ```
 
 ### BlobPipelineWithPermission
 ```
 New-AzStorageBlobSASToken -CloudBlob <CloudBlob> [-BlobBaseClient <BlobBaseClient>] [-Permission <String>]
- [-DelegatedUserObjectId <String>] [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>]
- [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
- [<CommonParameters>]
+ [-DelegatedUserObjectId <String>] [-DelegatedUserTenantId <String>] [-Protocol <SharedAccessProtocol>]
+ [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
+ [-EncryptionScope <String>] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
+ [-Confirm] [<CommonParameters>]
 ```
 
 ### BlobNameWithPolicy
 ```
 New-AzStorageBlobSASToken [-Container] <String> [-Blob] <String> -Policy <String>
- [-DelegatedUserObjectId <String>] [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>]
- [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
- [<CommonParameters>]
+ [-DelegatedUserObjectId <String>] [-DelegatedUserTenantId <String>] [-Protocol <SharedAccessProtocol>]
+ [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
+ [-EncryptionScope <String>] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
+ [-Confirm] [<CommonParameters>]
 ```
 
 ## DESCRIPTION
@@ -80,6 +80,14 @@ New-AzStorageBlobSASToken -Container "ContainerName" -Blob "BlobName" -Permissio
 
 This example generates a User Identity blob SAS token with storage context based on OAuth authentication
 
+### Example 4: Generate a User Delegation SAS token with delegated user credentials
+```powershell
+$ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount
+New-AzStorageBlobSASToken -Container "ContainerName" -Blob "BlobName" -Permission rwd -StartTime $StartTime -ExpiryTime $EndTime -Context $ctx -DelegatedUserObjectId "00000000-0000-0000-0000-000000000000" -DelegatedUserTenantId "00000000-0000-0000-0000-000000000000"
+```
+
+This example generates a User Delegation blob SAS token with OAuth authentication context, specifying the delegated user object ID and tenant ID for enhanced security.
+
 ## PARAMETERS
 
 ### -Blob
@@ -189,6 +197,21 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -DelegatedUserTenantId
+Optional. The delegated user tenant id in Azure AD. This parameter can only be specified when input Storage Context is OAuth based.
+
+```yaml
+Type: System.String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -EncryptionScope
 Encryption scope to use when sending requests authorized with this SAS URI.
 

diff --git a/src/Storage/Storage.Management/help/New-AzStorageContainerSASToken.md b/src/Storage/Storage.Management/help/New-AzStorageContainerSASToken.md
@@ -16,17 +16,19 @@ Generates an SAS token for an Azure storage container.
 ### SasPolicy
 ```
 New-AzStorageContainerSASToken [-Name] <String> -Policy <String> [-DelegatedUserObjectId <String>]
- [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
- [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>] [-Context <IStorageContext>]
- [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
+ [-DelegatedUserTenantId <String>] [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>]
+ [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>]
+ [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
 ```
 
 ### SasPermission
 ```
 New-AzStorageContainerSASToken [-Name] <String> [-Permission <String>] [-DelegatedUserObjectId <String>]
- [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
- [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>] [-Context <IStorageContext>]
- [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
+ [-DelegatedUserTenantId <String>] [-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>]
+ [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-EncryptionScope <String>]
+ [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
 ```
 
 ## DESCRIPTION
@@ -55,7 +57,7 @@ New-AzStorageContainerSASToken -Name "Test" -Policy "PolicyName"
 
 This example generates a container SAS token with shared access policy.
 
-### Example 3: Generate a User Identity container SAS token with storage context based on OAuth authentication
+### Example 4: Generate a User Identity container SAS token with storage context based on OAuth authentication
 ```powershell
 $ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount
 $StartTime = Get-Date
@@ -65,6 +67,14 @@ New-AzStorageContainerSASToken -Name "ContainerName" -Permission rwd -StartTime
 
 This example generates a User Identity container SAS token with storage context based on OAuth authentication
 
+### Example 5: Generate a User Delegation container SAS token with delegated user credentials
+```powershell
+$ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount
+New-AzStorageContainerSASToken -Name "ContainerName" -Permission rwd -StartTime $StartTime -ExpiryTime $EndTime -Context $ctx -DelegatedUserObjectId "00000000-0000-0000-0000-000000000000" -DelegatedUserTenantId "00000000-0000-0000-0000-000000000000"
+```
+
+This example generates a User Delegation container SAS token with OAuth authentication context, specifying the delegated user object ID and tenant ID for enhanced security.
+
 ## PARAMETERS
 
 ### -Context
@@ -114,6 +124,21 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -DelegatedUserTenantId
+Optional. The delegated user tenant id in Azure AD. This parameter can only be specified when input Storage Context is OAuth based.
+
+```yaml
+Type: System.String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -EncryptionScope
 Encryption scope to use when sending requests authorized with this SAS URI.
 

diff --git a/src/Storage/Storage.Management/help/New-AzStorageFileSASToken.md b/src/Storage/Storage.Management/help/New-AzStorageFileSASToken.md
@@ -16,32 +16,33 @@ Generates a shared access signature token for a Storage file.
 ### NameSasPermission
 ```
 New-AzStorageFileSASToken [-ShareName] <String> [-Path] <String> [-DelegatedUserObjectId <String>]
- [-Permission <String>] [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
- [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
- [<CommonParameters>]
+ [-DelegatedUserTenantId <String>] [-Permission <String>] [-Protocol <String>] [-IPAddressOrRange <String>]
+ [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>]
+ [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
 ```
 
 ### NameSasPolicy
 ```
 New-AzStorageFileSASToken [-ShareName] <String> [-Path] <String> -Policy <String>
- [-DelegatedUserObjectId <String>] [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
- [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
- [<CommonParameters>]
+ [-DelegatedUserObjectId <String>] [-DelegatedUserTenantId <String>] [-Protocol <String>]
+ [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
+ [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
 ```
 
 ### FileSasPermission
 ```
 New-AzStorageFileSASToken -ShareFileClient <ShareFileClient> [-DelegatedUserObjectId <String>]
- [-Permission <String>] [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
- [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
- [<CommonParameters>]
+ [-DelegatedUserTenantId <String>] [-Permission <String>] [-Protocol <String>] [-IPAddressOrRange <String>]
+ [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>]
+ [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
 ```
 
 ### FileSasPolicy
 ```
 New-AzStorageFileSASToken -ShareFileClient <ShareFileClient> -Policy <String> [-DelegatedUserObjectId <String>]
- [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
+ [-DelegatedUserTenantId <String>] [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
+ [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
+ [<CommonParameters>]
 ```
 
 ## DESCRIPTION
@@ -71,6 +72,14 @@ The third command generates a shared access signature token that has the specifi
 This token becomes valid at the current time.
 The token remains valid until time stored in $EndTime.
 
+### Example 3: Generate a User Delegation file SAS token with OAuth authentication context, and delegated user object ID and tenant ID
+```powershell
+$ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount  -EnableFileBackupRequestIntent
+New-AzStorageFileSASToken -ShareName "ContosoShare" -Path "FilePath" -Permission "rwd" -StartTime $StartTime -ExpiryTime $EndTime -Context $ctx -DelegatedUserObjectId "00000000-0000-0000-0000-000000000000" -DelegatedUserTenantId "00000000-0000-0000-0000-000000000000"
+```
+
+This example generates a User Delegation file SAS token with OAuth authentication context, specifying the delegated user object ID and tenant ID for enhanced security.
+
 ## PARAMETERS
 
 ### -Context
@@ -119,6 +128,21 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -DelegatedUserTenantId
+Optional. The delegated user tenant id in Azure AD. This parameter can only be specified when input Storage Context is OAuth based.
+
+```yaml
+Type: System.String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -ExpiryTime
 Specifies the time at which the shared access signature becomes invalid.
 

diff --git a/src/Storage/Storage.Management/help/New-AzStorageQueueSASToken.md b/src/Storage/Storage.Management/help/New-AzStorageQueueSASToken.md
@@ -16,15 +16,17 @@ Generates a shared access signature token for an Azure storage queue.
 ### SasPolicy
 ```
 New-AzStorageQueueSASToken [-Name] <String> -Policy <String> [-DelegatedUserObjectId <String>]
- [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
+ [-DelegatedUserTenantId <String>] [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
+ [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
+ [<CommonParameters>]
 ```
 
 ### SasPermission
 ```
 New-AzStorageQueueSASToken [-Name] <String> [-Permission <String>] [-DelegatedUserObjectId <String>]
- [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
- [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
+ [-DelegatedUserTenantId <String>] [-Protocol <String>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
+ [-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
+ [<CommonParameters>]
 ```
 
 ## DESCRIPTION
@@ -39,6 +41,14 @@ New-AzStorageQueueSASToken -Name "Test" -Permission raup
 
 This example generates a queue SAS token with full permission.
 
+### Example 2: Generate a User Delegation queue SAS token with OAuth authentication context, and delegated user object ID and tenant ID
+```powershell
+$ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount
+New-AzStorageQueueSASToken -Name "Test" -Permission raup -StartTime $StartTime -ExpiryTime $EndTime -Context $ctx -DelegatedUserObjectId "00000000-0000-0000-0000-000000000000" -DelegatedUserTenantId "00000000-0000-0000-0000-000000000000"
+```
+
+This example generates a User Delegation queue SAS token with OAuth authentication context, specifying the delegated user object ID and tenant ID for enhanced security.
+
 ## PARAMETERS
 
 ### -Context
@@ -87,6 +97,21 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -DelegatedUserTenantId
+Optional. The delegated user tenant id in Azure AD. This parameter can only be specified when input Storage Context is OAuth based.
+
+```yaml
+Type: System.String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -ExpiryTime
 Specifies when the shared access signature is no longer valid.