Restrict usage of user delegation SAS to an Entra ID identity