Prefix-scoped access for User Delegation SAS