Azure Blob Storage

Microsoft Azure Storage provides a massively scalable, durable, and highly available storage for data on the cloud, and serves as the data storage solution for modern applications. Connect to Blob Storage to perform various operations such as create, update, get and delete on blobs in your Azure Storage account.

This connector is available in the following products and regions:

Service	Class	Regions
Copilot Studio	Premium	All Power Automate regions
Logic Apps	Standard	All Logic Apps regions
Power Apps	Premium	All Power Apps regions
Power Automate	Premium	All Power Automate regions

Contact
Name	Microsoft
URL	https://azure.microsoft.com/support/

Connector Metadata
Publisher	Microsoft
Website	https://azure.microsoft.com/services/storage/blobs/
Privacy policy	https://privacy.microsoft.com/
Categories	Productivity

This article describes the operations for the Azure Blob Storage managed connector, which is available for Copilot Studio, Azure Logic Apps, Microsoft Power Automate, and Microsoft Power Apps.

For how to use this connector, see the following table:

Service	How to
Azure Logic Apps	Connect to Azure Blob Storage from Azure Logic Apps
Microsoft Power Apps	Connect to Azure Blob Storage from Power Apps

General known issues and limitations

The connector doesn't support blob names and paths that contain URL decodable characters, such as + or % followed by two hexadecimal digits.
For V2 operations, the parameter named Storage account name is automatically populated only when you use key-based authentication. When you use Microsoft Entra ID or managed identity authentication, enter the storage account name as a custom value.
The trigger named When a blob is added or modified (properties only) (V2) doesn't fire if a file is added or updated in a subfolder. If you require a trigger to work on subfolders, use multiple triggers.
The trigger named When a blob is added or modified (properties only) (V2) might sometimes delay immediately returning blobs and postpone newly created or modified blobs for the later trigger runs. The trigger doesn't guarantee to return all files in a single run when the Split on setting is disabled.
The trigger named When a blob is added or modified (properties only) (V2) has a behavior state that is set to either idle or conflict. The trigger behaves slightly differently when a single file is uploaded versus when multiple files are uploaded.
- For a single file, the trigger immediately fires, processes the file, and sends the appropriate response.
- For multiple files with the same timestamp, the trigger enters a conflicted state and takes the following actions:
  - Sends a response with the HTTP 200 OK status code and a retry-after header set to 6 seconds.
  - After 6 seconds pass, the trigger processes all the files that have the same timestamp.
For example, suppose you upload files to Azure Blob Storage from an SFTP server where file uploads can take up to one second. Without the 6-second wait, the trigger might miss partially uploaded files. The retry duration makes sure that all files finish uploading before the next trigger check.
The action named Extract archive to folder ignores empty files and folders in the archive. These items aren't extracted to the destination.
When you use the action named Create block blob (V2) without allowing chunking, the action occasionally creates blobs with the content type set to application/octet-stream. To find the chunking setting, go to the Settings tab.
The connector might send a no-op request to the backend.
The message size limit is 100 MB by design, per the limits in Azure Logic Apps. When you send files through a connector, the overall payload size must be under 100 MB, not just the file size. To work around this limit, consider allowing chunking, which you can find on the action's Settings tab.
In Azure Logic Apps, the connector can't directly access storage accounts that are behind firewalls if they're both in the same region. As a workaround, keep your storage account in a different region. For more information, see Access storage accounts behind firewalls.
In Power Platform services, the connector doesn't support connecting to storage accounts behind firewalls. Even if your connection works now, don't depend on the connection to work in the future. The only current workaround is not to use firewalls for your storage accounts.
In Power Apps, when you use the action named Create blob (V2) with access key authentication, make sure that the dataset parameter uses "AccountNameFromSettings", not the blob endpoint.
The connector doesn't support gateways. When you create an Azure Blob Storage connection, the incorrect option for Choose a gateway might appear.

Support for Azure Data Lake Storage Gen2

You can connect to Azure Data Lake Storage Gen2 (ADLS Gen2) accounts using multi-protocol access. For more information, including availability and known limitations, see Silo busting 2.0—Multi-protocol access for Azure Data Lake Storage.

Microsoft Entra ID authentication

To use Microsoft Entra ID authentication, the user account requires a specific role assignment. For more information, see Assign an Azure role for access to blob data - Azure Storage.

Note

Only roles explicitly defined for data access permit a security principal to access blob or queue data. Built-in roles such as Owner, Contributor, and Storage Account Contributor permit a security principal to manage a storage account, but do not provide access to the blob or queue data within that account via Microsoft Entra ID.

The following quick test confirms whether a user account has the required role to perform operations on a blob container:

In the Azure portal, sign in with the user account.
Go to the storage account and the blob container. Under the container toolbar, next to Authentication method: Access key, select Switch to Microsoft Entra user account.

This option appears immediately above the blob search box.

If an unauthorized message appears, the user account requires specific storage account permissions. For this task, the storage account manager can follow these steps:

On the container sidebar, select Access Control (IAM).
On the toolbar, select Add > Add role assignment.
On the Role tab, find and select appropriate Storage Account role required by the user account, for example, Storage Account Contributor. Select Next.
On the Members tab, choose + Select members, find and select the user account, choose Select, then choose Review + assign.

For more information about access roles for Blob Storage containers, see Authorize access to blobs using Microsoft Entra ID

Managed identity authentication

Currently, only Azure Logic Apps supports managed identity authentication. To set up and use this authentication for Azure Blob Storage connections in a logic app workflow, see Authenticate access and connections to Azure resources with managed identities in Azure Logic Apps.

Known limitations with Microsoft Entra ID and managed identity authentication

Microsoft Entra ID guest users aren't supported for Microsoft Entra ID connections to Azure Blob Storage, due to current authentication pipeline limitations.
Only V2 actions support Microsoft Entra ID and managed identity authentication. Deprecated actions continue to work with access key authentication, but these actions fail if used with Microsoft Entra ID or managed identity authentication.

As exceptions, the following V2 actions currently don't support Microsoft Entra ID or managed identity authentication. As a workaround, you can use access key authentication.
- Create SAS URI by path (V2)
- Get available access policies (V2)

Connect to Azure Blob Storage using a blob endpoint

For V2 operations or connections with access key authentication, enter the full Azure Storage blob endpoint as described:

If your connection uses access key authentication, in the parameter named Azure Storage Account Name Or Blob Endpoint, enter the full Azure Storage blob endpoint.
If you use a V2 operation with a connection that uses access key authentication, you must also provide the full Azure Storage blob endpoint in the dataset parameter.
The full blob endpoint includes the schema, for example:
- https://{account-name}.blob.core.windows.net/
- https://{account-name-secondary}.blob.core.windows.net/ if you connect to the secondary endpoint
- Relative paths such as {account-name}.blob.core.windows.net will be rejected.

Get the Azure Storage blob endpoint for a specific storage account

You can get the full blob endpoint in the following ways:

Azure portal

In the Azure portal, go to your Azure Storage account.
On the account sidebar, under Settings, select Endpoints.
In the Blob service section, find the Blob service property value, which is the full blob endpoint in the following format: https://{account-name}.blob.core.windows.net/

REST API

If you have access to the Azure Storage account, you can call the REST API method named Get Properties by following these steps:

In the Azure portal, go to your Azure Storage account. On the account sidebar, select Overview.
On the Overview page, under Essentials, copy and save the storage account's Subscription ID and Resource group name for the next steps.
Go to the REST API reference page named Storage Accounts - Get Properties.
In the HTTP box, at the top right corner, select Try it.
If you haven't signed in already, sign in now. Otherwise, confirm that you want to continue.
Choose the Azure tenant where the storage account exists.
Enter the storage account name, resource group name, and select the subscription associated with the storage account.
When you're done, select Run.
In the response's Body section, find the primaryEndpoints JSON object. In this object, find the blob property value, which is the full blob endpoint in the following format: https://{account-name}.blob.core.windows.net/

General Limits

Name	Value
Maximum file size with enabled chunking (in MB)	1024
Maximum file size with disabled chunking, maximum archive size for extraction, maximum size of a source for copy blob operation in case of absolute Uri (in MB)	50
Maximum number of files in archive	100
Maximum total size of files in archive (in MB)	750
Maximum page size for List blobs	5000
Maximum trackable number of items inside of a virtual folder for trigger	30000
Maximum number of megabytes being transferred to/from the connector within a bandwidth time interval (per connection)	300
Bandwidth time interval (in miliseconds)	1000
Maximum number of requests being processed by the connector concurrently	100
Maximum number of responses being transferred by the connector concurrently	200
API calls per connection per 1 minute for "Extract archive to folder operation"	150

Creating a connection

The connector supports the following authentication types:


Access Key	Provide Azure Storage account name (or blob endpoint) and Access Key to access your Azure Blob Storage.	All regions except Azure Government and Department of Defense (DoD) in Azure Government and US Government (GCC) and US Government (GCC-High)	Shareable
Access Key (Azure Government)	Provide Azure Storage account name (or blob endpoint) and Access Key to access your Azure Blob Storage.	Azure Government and Department of Defense (DoD) in Azure Government and US Government (GCC-High) only	Shareable
Access Key (Azure Government)	Provide Azure Storage account name (or blob endpoint) and Access Key to access your Azure Blob Storage in Azure Government.	US Government (GCC) only	Shareable
Client Certificate Auth	Provide Microsoft Entra ID credentials using PFX certificate and password	All regions	Shareable
Logic Apps Managed Identity	Create a connection using a LogicApps Managed Identity	LOGICAPPS only	Shareable
Microsoft Entra ID Integrated	Use Microsoft Entra ID to access your Azure Blob storage.	All regions except Azure Government and Department of Defense (DoD) in Azure Government and US Government (GCC) and US Government (GCC-High)	Not shareable
Microsoft Entra ID Integrated (Azure Commercial)	Use Microsoft Entra ID to access your Azure Blob Storage in Azure Commercial.	US Government (GCC) only	Not shareable
Microsoft Entra ID Integrated (Azure Government)	Use Microsoft Entra ID to access your Azure Blob storage.	Azure Government and Department of Defense (DoD) in Azure Government and US Government (GCC-High) only	Not shareable
Microsoft Entra ID Integrated (Azure Government)	Use Microsoft Entra ID to access your Azure Blob storage in Azure Government.	US Government (GCC) only	Not shareable
Service principal authentication	Use your own Microsoft Entra ID app for service principal authentication.	All regions	Not shareable
Default [DEPRECATED]	This option is only for older connections without an explicit authentication type, and is only provided for backward compatibility.	All regions	Not shareable

Access Key

Auth ID: keyBasedAuth

Applicable: All regions except Azure Government and Department of Defense (DoD) in Azure Government and US Government (GCC) and US Government (GCC-High)

Provide Azure Storage account name (or blob endpoint) and Access Key to access your Azure Blob Storage.

This is shareable connection. If the power app is shared with another user, connection is shared as well. For more information, please see the Connectors overview for canvas apps - Power Apps | Microsoft Docs

Name	Type	Description	Required
Azure Storage account name or blob endpoint	string	Name or blob endpoint of the Azure Storage account the connector should use.	True
Azure Storage Account Access Key	securestring	Specify a valid primary/secondary Azure Storage account access key.

Access Key (Azure Government)

Auth ID: keyBasedAuth

Applicable: Azure Government and Department of Defense (DoD) in Azure Government and US Government (GCC-High) only

Provide Azure Storage account name (or blob endpoint) and Access Key to access your Azure Blob Storage.

Name	Type	Description	Required
Azure Storage account name or blob endpoint	string	Name or blob endpoint of the Azure Storage account the connector should use.	True
Azure Storage Account Access Key	securestring	Specify a valid primary/secondary Azure Storage account access key.

Access Key (Azure Government)

Auth ID: keyBasedAuth

Applicable: US Government (GCC) only

Provide Azure Storage account name (or blob endpoint) and Access Key to access your Azure Blob Storage in Azure Government.

Name	Type	Description	Required
Azure Storage account name or blob endpoint	string	Name or blob endpoint of the Azure Storage account the connector should use.	True
Azure Storage Account Access Key	securestring	Specify a valid primary/secondary Azure Storage account access key.

Client Certificate Auth

Auth ID: certOauth

Applicable: All regions

Provide Microsoft Entra ID credentials using PFX certificate and password

Name	Type	Description	Required
Client ID	string		True
Client certificate secret	clientCertificate	The client certificate secret allowed by this application	True
Tenant	string		True

Logic Apps Managed Identity

Auth ID: managedIdentityAuth

Applicable: LOGICAPPS only

Create a connection using a LogicApps Managed Identity

Name	Type	Description	Required
LogicApps Managed Identity	managedIdentity	Sign in with a Logic Apps Managed Identity	True

Microsoft Entra ID Integrated

Auth ID: tokenBasedAuth

Applicable: All regions except Azure Government and Department of Defense (DoD) in Azure Government and US Government (GCC) and US Government (GCC-High)

Use Microsoft Entra ID to access your Azure Blob storage.