Fail to connect via Python SDK to Azure Blob Storage connection found in Azure AI Foundry project

Question

I am trying to access via Python SDK my Azure Blob Storage container from a connection that I have created in my Azure AI Foundry project. I am using the below script to do that but I get ResourceNotFound error:

self.project = AIProjectClient.from_connection_string(
	conn_str=os.environ["AIPROJECT_CONNECTION_STRING"],	
	credential=DefaultAzureCredential()
)

storage_connection_details = self.project.connections.get_default(
	connection_type=ConnectionType.AZURE_BLOB_STORAGE,
	include_credentials=True
)

I confirm that it correctly connects to the Azure AI Foundry project since all connections are listed normally with self.project.connections.list(), including the Azure Blob Storage ones.

Finally, I can normally connect to other project's connections (e.g. in my Azure AI Search connection with below script).

search_connection = self.project.connections.get_default(
	connection_type=ConnectionType.AZURE_AI_SEARCH, 
	include_credentials=True
)

Would highly appreciate any assistance on what I might be doing wrong with the Azure Blob Storage connection.

Appreciate your help, thank you in advance.

Answer 1

Hi Paris Perlegkas

According to this MS-Document,

To obtain the Azure Blob storage connection for the Azure AI Foundry project, you need to use the include_credentials=False parameter in your code.

Now, when I used the below code with include_credentials=False and I got the output of blob storage connection and list of blobs.

Code:

from azure.identity import DefaultAzureCredential
from azure.ai.projects import AIProjectClient
from azure.ai.projects.models import ConnectionType
from azure.storage.blob import ContainerClient
from urllib.parse import urlparse


credential = DefaultAzureCredential()

client = AIProjectClient.from_connection_string(
    conn_str="xxxx"
    credential=credential
)


storage_connection = client.connections.get_default(
    connection_type=ConnectionType.AZURE_BLOB_STORAGE,
    include_credentials=False 
)

print(storage_connection)

parsed = urlparse(storage_connection.endpoint_url)


account_name = parsed.netloc.split('.')[0]
account_url = f"https://{account_name}.blob.core.windows.net"
container_name = parsed.path.lstrip('/')

print("Account URL:", account_url)
print("Container Name:", container_name)


container_client = ContainerClient(
    account_url=account_url,
    container_name=container_name,
    credential=credential
)


print(f"Blobs in container '{container_name}':")
try:
    for blob in container_client.list_blobs():
        print(blob.name)
except Exception as e:
    print(f"Error listing blobs: {e}")

Output:

Hope this answer helps! please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Hi there Paris Perlegkas

Thanks for using QandA platfoem

Your script looks mostly correct.

The connection gives you the storage account, but not the container. Make sure you're specifying the container name explicitly when creating the BlobServiceClient or ContainerClient.

Even though include_credentials=True, verify that the identity (either managed or via DefaultAzureCredential) has the right role (e.g., Storage Blob Data Reader/Contributor) assigned at the storage account or container level.

Try this pattern after fetching the connection:

from azure.storage.blob import BlobServiceClient

blob_service = BlobServiceClient(
    account_url=storage_connection_details.config["account_url"],
    credential=storage_connection_details.credentials.get("account_key")
)

container_client = blob_service.get_container_client("your-container-name")
blobs = list(container_client.list_blobs())

Check account_url and account_key are populated correctly. If you’re using identity-based auth instead, use DefaultAzureCredential() and skip the account_key.

If this helps kindly accept the answer thanks much

Answer 3

Hi Paris Perlegkas ,

Before reaching the BlobServiceClient creation step, let's focus on the connection setup within your Azure AI Foundry project.ensure that the connection details retrieved from self.project.connections.get_default are correct and contain the necessary information to access the Blob Storage. You can print out the connection details to verify,

print(storage_connection_details)

Check that the connection type specified (ConnectionType.AZURE_BLOB_STORAGE) is correct and matches the connection type in your Azure AI Foundry project.

Ensure that the role assignment for Storage Blob Data Contributor is correctly applied to the user or service principal you're using. You can verify this in the Azure Portal under the IAM section of your storage account.

Example to ensure the connection setup is correct:

from azure.identity import DefaultAzureCredential
from azure.ai.foundry import AIProjectClient, ConnectionType
import os

project = AIProjectClient.from_connection_string(
    conn_str=os.environ["AIPROJECT_CONNECTION_STRING"],
    credential=DefaultAzureCredential()
)

storage_connection_details = project.connections.get_default(
    connection_type=ConnectionType.AZURE_BLOB_STORAGE,
    include_credentials=True
)

print(storage_connection_details)

For more information:
https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-python?tabs=managed-identity%2Croles-azure-portal%2Csign-in-azure-cli&pivots=blob-storage-quickstart-scratch

https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.defaultazurecredential?view=azure-python

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be glad to assist you.