Can a SAS key become invalid due to the settings change in a storage account? eg: If we change Network access or IP whitelisting? SAS key can have IP enabled or not, does it matter?
How it works internally is that it takes the querystring and uses a hashing algorithm (SHA-256) with your credentials (e.g. access key) to create a signature that's added to the querystring. The same is done on the other end to verify you have access.
So in other words: Unless the credentials become invalid (e.g. by rotating the access keys) the SAS token remains valid as it's otherwise only dependent on your link which remains static. The firewall is however a different layer of security so even if the SAS token is valid the firewall can still block network access.