RESTORE FILELISTONLY FROM URL = '' WITH CREDENTIAL = '' fails in SQL 2016.

Copied script from SQL 2012 environment, successfully restoring from Azure Storage Container, with create credential statement, and it failed in 2016.

Error message "Forbidden".

Only after logging into the Azure Portal, creating a Shared Access Signature for the container, could I execute the restore, and only by NOT SPECIFYING the credential did the restore work.

No documentation advises that a SAS (Shared Access Signature) is required in SQL 2016 for Azure container backup / restore.

Is there another way to use T-SQL to access blob backups on Azure storage containers in SQL Server 2016, than using SAS?