I created a SAS token using the following python function:

def generate_sas_token(connection_string: str, container_name: str, blob_name: str, duration: int = 60) -> tuple[str, str]:
    blob_service_client = BlobServiceClient.from_connection_string(connection_string)
    sas_token = generate_blob_sas(
        account_name=blob_service_client.account_name,
        container_name=container_name,
        blob_name=blob_name,
        account_key=blob_service_client.credential.account_key,
        permission=BlobSasPermissions(read=True),  # Set the permissions as needed
        expiry=datetime.now() + timedelta(minutes=duration)  # Set the expiry time as needed
    )
    sas_url = f"https://{blob_service_client.account_name}.blob.core.windows.net/{container_name}/{blob_name}?{sas_token}"
    return sas_token, sas_url

As you can see I specify the expiry date by using a 60 minutes offset to the current time. So I would expect the token to be invalid after 60 minutes. However even 2 hours later the SAS token is still valid. I opened the SAS url in another browser in private mode to prevent any browser caching messing sth up but I was still able to download the file just fine.
The documentation mentions that the ‘expiry’ field can be overwritten by an access policy but I checked my storage account and there are no access policies present.

Is there anything I missed as I don’t see any errors in the code?