<p>Technically there is no limit according to various <a href="https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-dev-guide-sas?tabs=node#security-tokens" rel="nofollow noreferrer">documentation</a> I've looked at.</p>
<p>There may be some limitations imposed by the UI you are using (typically 1 year as you've seen), but if you generate the token with the CLI or programmatically there should be no upper limit within reason (a large enough number could exceed the data capacity of various things, but a hundred years is <a href="https://docs.microsoft.com/en-us/answers/questions/248227/signed-access-signature-sas-which-never-expires.html" rel="nofollow noreferrer">reported</a> to work fine).</p>
<p>Another limit is one imposed by security best practices, but I don't believe that's within the scope of this question.</p>

CC BY-SA 4.0
2021-11-11T18:14:36.667Z
Thank you for your answer Benjamin. I agree with you: keeping the SAS token unchanged for an extended period of time is not a good practice from a cybersecurity perspective... But that's another story!
Sheldon
CC BY-SA 4.0
2021-11-09T20:14:53.007Z
2021-11-09T20:14:53.007Z
Benjamin Isaacson
<p>I want to send messages to the <strong>Azure IoT Hub</strong> using the <strong>MQTT</strong> protocol.
I followed <a href="https://www.youtube.com/watch?v=wn4NlYtE9Ys" rel="nofollow noreferrer">this video</a> and managed to connect my Linux-based device (a <strong>Raspberry Pi</strong>) to the IoT Hub.</p>
<p>As instructed in the aforementioned tutorial, I used the <strong>Azure IoT Explorer</strong> to generate a connection string with SAS token.</p>
<p>However I noticed that the user is prompted to define an expiration for the SAS token, given in minutes (second box from the bottom in the image below): <a href="https://i.sstatic.net/6BAyA.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/6BAyA.png" alt="enter image description here" /></a></p>
<p>I would like to have my device send messages to Azure over extended periods of time (<em>i.e.</em> several weeks). How can I specify such a long duration?</p>
<p>I tried passing 20,000 minutes (~ 1 month) as an argument. I was able to generate a seemingly valid <strong>SAS token connection string</strong>, but then again, if I pass an aberrant value (<em>e.g.</em> 0 or -1) I am still able to generate a token. Although my token is currently working, I am concerned that it will expire after a default &quot;maximum expiration duration&quot;.</p>
<p>So what is the maximum duration that can be passed in the <strong>Expiration (minutes)</strong> field?</p>
<p><strong>EDIT:</strong> according to <a href="https://stackoverflow.com/questions/63500628/mosquitto-broker-setup-bridge-in-raspberry-pi-to-iot-hub-sas-token">this SO post</a>, the maximum expiration date for the SAS token is 365 days:</p>
<blockquote>
<p>You can specify the expiration date for a SAS token, I think the
maximum is 365 days, but forever is not a possibility.</p>
</blockquote>

<azure><authentication>
What is the maximum expiration duration for Azure SAS token created to connect to the Azure IoT Hub?
Sheldon
# What is the maximum expiration duration for Azure SAS token created to connect to the Azure IoT Hub?

(Asked by: username_0 on 2021-11-03)

I want to send messages to the **Azure IoT Hub** using the **MQTT** protocol.
I followed [this video](https://www.youtube.com/watch?v=wn4NlYtE9Ys) and managed to connect my Linux-based device (a **Raspberry Pi**) to the IoT Hub.

As instructed in the aforementioned tutorial, I used the **Azure IoT Explorer** to generate a connection string with SAS token.

However I noticed that the user is prompted to define an expiration for the SAS token, given in minutes (second box from the bottom in the image below): [![enter image description here](https://i.sstatic.net/6BAyA.png)](https://i.sstatic.net/6BAyA.png)

I would like to have my device send messages to Azure over extended periods of time (*i.e.* several weeks). How can I specify such a long duration?

I tried passing 20,000 minutes (~ 1 month) as an argument. I was able to generate a seemingly valid **SAS token connection string**, but then again, if I pass an aberrant value (*e.g.* 0 or -1) I am still able to generate a token. Although my token is currently working, I am concerned that it will expire after a default "maximum expiration duration".

So what is the maximum duration that can be passed in the **Expiration (minutes)** field?

**EDIT:** according to [this SO post](https://stackoverflow.com/questions/63500628/mosquitto-broker-setup-bridge-in-raspberry-pi-to-iot-hub-sas-token), the maximum expiration date for the SAS token is 365 days:

> You can specify the expiration date for a SAS token, I think the
> maximum is 365 days, but forever is not a possibility.

**Tags:** azure, authentication


---

## 1 answers

### Answer by username_1 on 2021-11-09. Score: 0 | Accepted answer

Technically there is no limit according to various [documentation](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-dev-guide-sas?tabs=node#security-tokens) I've looked at.

There may be some limitations imposed by the UI you are using (typically 1 year as you've seen), but if you generate the token with the CLI or programmatically there should be no upper limit within reason (a large enough number could exceed the data capacity of various things, but a hundred years is [reported](https://docs.microsoft.com/en-us/answers/questions/248227/signed-access-signature-sas-which-never-expires.html) to work fine).

Another limit is one imposed by security best practices, but I don't believe that's within the scope of this question.

> **Comments:**
> **username_0**: Thank you for your answer Benjamin. I agree with you: keeping the SAS token unchanged for an extended period of time is not a good practice from a cybersecurity perspective... But that's another story!  

---

