After introducing https://github.com/elastic/elasticsearch/pull/86135 the underlying Azure SDK sanitizes incorrectly certain SAS tokens, preventing the correct authentication against the Azure storage service.
modules/repository-azure/src/main/java/org/elasticsearch/repositories/azure/AzureClientProvider.java
builder.addPolicy(new SuccessfulRequestTracker(successfulRequestConsumer));
        }
        if (locationMode.isSecondary()) {
            
            StorageConnectionString storageConnectionString = StorageConnectionString.create(connectionString, clientLogger);
            String secondaryUri = storageConnectionString.getBlobEndpoint().getSecondaryUri();
            if (secondaryUri == null) {
                throw new IllegalArgumentException(
                    "Unable to configure an AzureClient using a secondary location without a secondary " + "endpoint"
                );
            }
            builder.endpoint(secondaryUri);
        }
        BlobServiceClient blobServiceClient = SocketAccess.doPrivilegedException(builder::buildClient);
        BlobServiceAsyncClient asyncClient = SocketAccess.doPrivilegedException(builder::buildAsyncClient);
        return new AzureBlobServiceClient(blobServiceClient, asyncClient, settings.getMaxRetries(), byteBufAllocator);
    }
    @Override
    protected void doStart() {
        ReactorScheduledExecutorService executorService = new ReactorScheduledExecutorService(threadPool, reactorExecutorName) {
            @Override
            protected Runnable decorateRunnable(Runnable command) {
                return () -> SocketAccess.doPrivilegedVoidException(command::run);
            }
            @Override
            protected <V> Callable<V> decorateCallable(Callable<V> callable) {
                return () -> SocketAccess.doPrivilegedException(callable::call);
            }
        };