I am trying to generate a URL where users can access a file that is in a blob storage container on Azure. The blob storage container is heavily restricted by IP address, and then the service I'm building will manage requests and generate a URL where users can access the file directly. Here is the code used to generate the URL (I think the code itself is probably fine).
CloudBlobContainer container = BlobStorage.GetContainer(_accountStatementEmailConfig.BlobStorageContainerName);
CloudBlockBlob blob = container.GetBlockBlobReference(document.StoragePath);

if (!blob.Exists())
{
    return NotFound();
}

TimeSpan sasExpiryTime = TimeSpan.FromMinutes(_apiConfig.PresignedURLExpiryInMinutes);

SharedAccessBlobPermissions permissions = SharedAccessBlobPermissions.Read;

string sasToken = blob.GetSharedAccessSignature(new SharedAccessBlobPolicy
{
    Permissions = permissions,
    SharedAccessExpiryTime = DateTime.UtcNow.Add(sasExpiryTime)
}, new SharedAccessBlobHeaders(), _apiConfig.SharedAccessSignaturePermissionsPolicyName);

string documentUrl = $"{blob.Uri.AbsoluteUri}{sasToken}";

The code generates the URL fine, but when a user goes to the URL they receive the following error:
<Error>
    <Code>AuthorizationFailure</Code>
    <Message>
        This request is not authorized to perform this operation. RequestId:92d7ca35-501e-0016-2a65-973659000000 Time:2023-06-01T08:43:35.2439678Z
    </Message>
</Error>

It was perhaps my incorrect assumption about SAS that the token would allow me to bypass the IP restrictions since I am generating the URL from a whitelisted IP. Am I taking the incorrect approach, or is there something minor I am overlooking?

Azure blob storage returns Unauthorized with SAS generated URL
As Gaurav Mantri pointed out in comments, the issue is my understanding of how Azure handles permissions since all of my previous experience is from AWS.
In Azure the storage account and the containers have separate access levels. Can achieve similar functionality to AWS's private + presignedURL option by setting the Storage Account to public, and each of the individual containers to private. Then using the generated SAS URL to access the file.
