diff --git a/extensions/data-plane/data-plane-azure-storage/src/main/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactory.java b/extensions/data-plane/data-plane-azure-storage/src/main/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactory.java
index d3b81f11..ff765c24 100644
--- a/extensions/data-plane/data-plane-azure-storage/src/main/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactory.java
+++ b/extensions/data-plane/data-plane-azure-storage/src/main/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactory.java
@@ -82,6 +82,11 @@ public DataSink createSink(DataFlowStartMessage request) {
         var requestId = request.getId();
 
         var secret = vault.resolveSecret(dataAddress.getKeyName());
+
+        if (secret == null) {
+            throw new EdcException("SAS token for the Azure Blob DataSink not found in Vault (alias = '%s')".formatted(dataAddress.getKeyName()));
+        }
+
         var token = typeManager.readValue(secret, AzureSasToken.class);
         var folderName = dataAddress.getStringProperty(AzureBlobStoreSchema.FOLDER_NAME);
         var blobName = dataAddress.getStringProperty(AzureBlobStoreSchema.BLOB_NAME);
diff --git a/extensions/data-plane/data-plane-azure-storage/src/test/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactoryTest.java b/extensions/data-plane/data-plane-azure-storage/src/test/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactoryTest.java
index 823da45c..91850252 100644
--- a/extensions/data-plane/data-plane-azure-storage/src/test/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactoryTest.java
+++ b/extensions/data-plane/data-plane-azure-storage/src/test/java/org/eclipse/edc/connector/dataplane/azure/storage/pipeline/AzureStorageDataSinkFactoryTest.java
@@ -32,12 +32,12 @@
 import java.util.concurrent.Executors;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.eclipse.edc.azure.blob.testfixtures.AzureStorageTestFixtures.createAccountName;
-import static org.eclipse.edc.azure.blob.testfixtures.AzureStorageTestFixtures.createBlobName;
 import static org.eclipse.edc.azure.blob.testfixtures.AzureStorageTestFixtures.createBlobPrefix;
 import static org.eclipse.edc.azure.blob.testfixtures.AzureStorageTestFixtures.createContainerName;
 import static org.eclipse.edc.azure.blob.testfixtures.AzureStorageTestFixtures.createRequest;
-import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -54,7 +54,8 @@ class AzureStorageDataSinkFactoryTest {
 
     private final String accountName = createAccountName();
     private final String containerName = createContainerName();
-    private final String blobName = createBlobName();
+
+
     private final String blobPrefix = createBlobPrefix();
     private final String keyName = "test-keyname";
     private final AzureSasToken token = new AzureSasToken("test-writeonly-sas", new Random().nextLong());
@@ -135,6 +136,21 @@ void createSink_whenValidRequest_succeeds() {
 
     @Test
     void createSink_whenInvalidRequest_fails() {
-        assertThrows(EdcException.class, () -> factory.createSink(invalidRequest.build()));
+        assertThatThrownBy(() -> factory.createSink(invalidRequest.build()))
+                .isInstanceOf(EdcException.class)
+                .hasMessageContaining("AzureStorage destination address is invalid: Invalid account name, the name may not be null, empty or blank");
+    }
+
+    @Test
+    void createSink_whenSecretNotFoundRequest_fails() {
+        when(vault.resolveSecret(anyString())).thenReturn(null);
+        var validRequest = request.destinationDataAddress(dataAddress
+                .property(AzureBlobStoreSchema.ACCOUNT_NAME, accountName)
+                .property(AzureBlobStoreSchema.CONTAINER_NAME, containerName)
+                .keyName(keyName)
+                .build());
+        assertThatThrownBy(() -> factory.createSink(validRequest.build()))
+                .isInstanceOf(EdcException.class)
+                .hasMessageStartingWith("SAS token for the Azure Blob DataSink not found in Vault");
     }
 }