I am encountering an issue when generating a Shared Access Signature (SAS) URL for a file in Azure Blob Storage using managed identity. The generated SAS URL contains a ‘+’ sign in the signature field, which causes the error “Signature fields not well formed” when trying to use the URL for access.

public string GenerateSaS(string account,
                          string containerName,
                          string fileName,
                          int expiryTimeInMins)
{
    try
    {
        var tokenCredential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = Environment.GetEnvironmentVariable("<My CLient Id>") });
        BlobServiceClient blobServiceClient = new BlobServiceClient(new Uri($"https://{account}.blob.core.windows.net/"), tokenCredential);
        BlobContainerClient containerClient = blobServiceClient.GetBlobContainerClient(containerName);

        // Check if the container exists
        if (!containerClient.Exists())
        {
            return null;
        }

        // Create a BlobSasBuilder instance
        var sharedPolicy = new BlobSasBuilder
        {
            StartsOn = DateTimeOffset.UtcNow,
            ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(expiryTimeInMins),
            ContentDisposition = $"attachment;filename={fileName}",
            BlobContainerName = containerName,
            BlobName = fileName,
            Resource = "b", // Blob-level access
            Protocol = SasProtocol.Https // Use HTTPS only
        };
        sharedPolicy.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write | BlobSasPermissions.Create);

        // Generate SAS token and create BlobUriBuilder
        BlobClient blobClient = containerClient.GetBlobClient(fileName);
        var blobUriBuilder = new BlobUriBuilder(blobClient.Uri)
        {
            Sas = sharedPolicy.ToSasQueryParameters(blobServiceClient.GetUserDelegationKey(DateTimeOffset.UtcNow.AddMinutes(-2), DateTimeOffset.UtcNow.AddMinutes(2)), blobServiceClient.AccountName)
        };

        // Convert BlobUriBuilder to URL string
        var url = blobUriBuilder.ToUri().ToString();

        return url;
    }
    catch (Exception ex)
    {
        // Handle exception
        throw ex;
    }
}

Signature sample in the url => sig=7SAJlSwRz8RNMQkEV4Y+hfIMEfVIRFapY49U/vqf4cI=

I tried diffrent ways to generate the url but no luck.
I am expecting a working solution for this issue