We would very much like to avoid the update of the url to the file in our application when the SAS token is updated. Is there a way to pass the token not in the url? I did not find any info on that and I think it is impossible but thought I'd ask anyway.
Unfortunately not, it has to be part of the url.
What you can do is write a little proxy app service that operated in the way you want by passing it as a header and translating it for you. Alternatively (I am not 100% sure) but you may be able to map it in API Gateway. Have a rummage around here.