We have Azure production tables and WADLogs table in the same storage account. So I would like to give SAS token for WADLogs table to this Add ON for pulling logs instead of exposing the SAS token of the entire storage. Is it supported?
This is a question for Microsoft/Azure team, not Splunk.
As far as I know, no -- it doesn't seem to be supported at this time.
