Integrate Azure Blob Storage with Service Connector

This page shows the supported authentication types, client types and sample code of Azure Blob Storage using Service Connector. This page also shows default environment variable names and values (or Spring Boot configuration) you get when you create the service connection.

Supported compute services

• Azure App Service
• Azure Functions
• Azure Container Apps
• Azure Spring Apps

Supported authentication types and client types

Supported authentication and clients for App Service, Azure Functions, Container Apps and Azure Spring Apps:

Client type	System-assigned managed identity	User-assigned managed identity	Secret / connection string	Service principal
.NET
Java
Java - Spring Boot
Node.js
Python
Go
None

---

Default environment variable names or application properties and sample code

Reference the connection details and sample code in the following tables, according to your connection's authentication type and client type, to connect compute services to Azure Blob Storage. You can learn more about Service Connector environment variable naming convention.

System-assigned managed identity

For default environment variables and sample code of other authentication type, please choose from beginning of the documentation.

Default environment variable name	Description	Example value
AZURE_STORAGEBLOB_RESOURCEENDPOINT	Blob Storage endpoint	https://<storage-account-name>.blob.core.windows.net/

Sample code

Refer to the steps and code below to connect to Azure Blob Storage using a system-assigned managed identity.

.NET

You can use azure-identity to authenticate via managed identity or service principal. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

Install dependencies

dotnet add package Azure.Identity

Here's sample code to connect to Blob storage using managed identity or service principal.

using Azure.Identity;
using Azure.Storage.Blobs;

// get Blob endpoint
var blobEndpoint = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_RESOURCEENDPOINT");

// Uncomment the following lines according to the authentication type.
// system-assigned managed identity
// var credential = new DefaultAzureCredential();

// user-assigned managed identity
// var credential = new DefaultAzureCredential(
//     new DefaultAzureCredentialOptions
//     {
//         ManagedIdentityClientId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTID");
//     });

// service principal 
// var tenantId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_TENANTID");
// var clientId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTID");
// var clientSecret = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTSECRET");
// var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);

var blobServiceClient = new BlobServiceClient(
        new Uri(blobEndpoint),
        credential);

Java

1. Add the following dependencies in your pom.xml file:

   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-storage-blob</artifactId>
   </dependency>
   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
       <version>1.1.5</version>
   </dependency>
   

2. Authenticate using azure-identity and get the endpoint URL from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   String url = System.getenv("AZURE_STORAGEBLOB_RESOURCEENDPOINT");  
   
   // Uncomment the following lines according to the authentication type.
   // for system managed identity
   // DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder().build();
   
   // for user assigned managed identity
   // DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder()
   //     .managedIdentityClientId(System.getenv("AZURE_STORAGEBLOB_CLIENTID"))
   //     .build();
   
   // for service principal
   // ClientSecretCredential defaultCredential = new ClientSecretCredentialBuilder()
   //   .clientId(System.getenv("<AZURE_STORAGEBLOB_CLIENTID>"))
   //   .clientSecret(System.getenv("<AZURE_STORAGEBLOB_CLIENTSECRET>"))
   //   .tenantId(System.getenv("<AZURE_STORAGEBLOB_TENANTID>"))
   //   .build();
   
   BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
       .endpoint(url)
       .credential(defaultCredential)
       .buildClient();
   

springBoot

Authentication type is not supported for Spring Boot.

Python

1. Install dependencies

   pip install azure-identity
   pip install azure-storage-blob
   

2. Authenticate using azure-identity library and get the endpoint URL from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   from azure.identity import ManagedIdentityCredential, ClientSecretCredential
   from azure.storage.blob import BlobServiceClient
   import os
   
   account_url = os.getenv('AZURE_STORAGEBLOB_RESOURCEENDPOINT')
   
   # Uncomment the following lines according to the authentication type.
   # system assigned managed identity
   # cred = ManagedIdentityCredential()
   
   # user assigned managed identity
   # managed_identity_client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # cred = ManagedIdentityCredential(client_id=managed_identity_client_id)
   
   # service principal
   # tenant_id = os.getenv('AZURE_STORAGEBLOB_TENANTID')
   # client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # client_secret = os.getenv('AZURE_STORAGEBLOB_CLIENTSECRET')
   # cred = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret) 
   
   blob_service_client = BlobServiceClient(account_url, credential=cred)
   

Django

1. Install dependencies.

   pip install azure-identity
   pip install django-storages[azure]
   

2. Authenticate via azure-identity library. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   from azure.identity import ManagedIdentityCredential, ClientSecretCredential
   import os
   
   # Uncomment the following lines according to the authentication type.
   # system assigned managed identity
   # cred = ManagedIdentityCredential()
   
   # user assigned managed identity
   # managed_identity_client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # cred = ManagedIdentityCredential(client_id=managed_identity_client_id)
   
   # service principal
   # tenant_id = os.getenv('AZURE_STORAGEBLOB_TENANTID')
   # client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # client_secret = os.getenv('AZURE_STORAGEBLOB_CLIENTSECRET')
   # cred = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)
   

3. In setting file, add following lines. For more information, see django-storages[azure].

   # in your setting file, eg. settings.py
   AZURE_CUSTOM_DOMAIN = os.getenv('AZURE_STORAGEBLOB_RESOURCEENDPOINT')
   AZURE_ACCOUNT_NAME = AZURE_CUSTOM_DOMAIN.split('.')[0].removeprefix('https://')    
   AZURE_TOKEN_CREDENTIAL = cred # this is the cred acquired from above step.
   
   

Go

1. Install dependencies.

   go get "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
   go get "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   

2. In code, authenticate via azidentity library. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   import (
     "context"
   
     "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
     "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   )
   
   
   func main() {
   
     account_endpoint = os.Getenv("AZURE_STORAGEBLOB_RESOURCEENDPOINT")
   
     // Uncomment the following lines according to the authentication type.
     // for system-assigned managed identity
     // cred, err := azidentity.NewDefaultAzureCredential(nil)
   
     // for user-assigned managed identity
     // clientid := os.Getenv("AZURE_STORAGEBLOB_CLIENTID")
     // azidentity.ManagedIdentityCredentialOptions.ID := clientid
     // options := &azidentity.ManagedIdentityCredentialOptions{ID: clientid}
     // cred, err := azidentity.NewManagedIdentityCredential(options)
   
     // for service principal
     // clientid := os.Getenv("AZURE_STORAGEBLOB_CLIENTID")
     // tenantid := os.Getenv("AZURE_STORAGEBLOB_TENANTID")
     // clientsecret := os.Getenv("AZURE_STORAGEBLOB_CLIENTSECRET")
     // cred, err := azidentity.NewClientSecretCredential(tenantid, clientid, clientsecret, &azidentity.ClientSecretCredentialOptions{})
   
     if err != nil {
       // error handling
     }
   
     client, err := azblob.NewBlobServiceClient(account_endpoint, cred, nil)
   }
   

NodeJS

1. Install dependencies

   npm install --save @azure/identity
   npm install @azure/storage-blob
   

2. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. Authenticate via @azure/identity library. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   import { DefaultAzureCredential,ClientSecretCredential } from "@azure/identity";
   
   const { BlobServiceClient } = require("@azure/storage-blob");
   
   const account_url = process.env.AZURE_STORAGEBLOB_RESOURCEENDPOINT;
   
   // Uncomment the following lines according to the authentication type.
   // for system assigned managed identity
   // const credential = new DefaultAzureCredential();
   
   // for user assigned managed identity
   // const clientId = process.env.AZURE_STORAGEBLOB_CLIENTID;
   // const credential = new DefaultAzureCredential({
   //     managedIdentityClientId: clientId
   // });
   
   // for service principal
   // const tenantId = process.env.AZURE_STORAGEBLOB_TENANTID;
   // const clientId = process.env.AZURE_STORAGEBLOB_CLIENTID;
   // const clientSecret = process.env.AZURE_STORAGEBLOB_CLIENTSECRET;
   // const credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
   
   const blobServiceClient = new BlobServiceClient(account_url, credential);
   

Other

For other languages, you can use the Azure Blob Storage account url and other properties that Service Connector sets to the environment variables to connect to Azure Blob storage. For environment variable details, see Integrate Azure Blob Storage with Service Connector.

User-assigned managed identity

For default environment variables and sample code of other authentication type, please choose from beginning of the documentation.

Default environment variable name	Description	Example value
AZURE_STORAGEBLOB_RESOURCEENDPOINT	Blob Storage endpoint	https://<storage-account-name>.blob.core.windows.net/
AZURE_STORAGEBLOB_CLIENTID	Your client ID	<client-ID>

Sample code

Refer to the steps and code below to connect to Azure Blob Storage using a user-assigned managed identity.

.NET

You can use azure-identity to authenticate via managed identity or service principal. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

Install dependencies

dotnet add package Azure.Identity

Here's sample code to connect to Blob storage using managed identity or service principal.

using Azure.Identity;
using Azure.Storage.Blobs;

// get Blob endpoint
var blobEndpoint = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_RESOURCEENDPOINT");

// Uncomment the following lines according to the authentication type.
// system-assigned managed identity
// var credential = new DefaultAzureCredential();

// user-assigned managed identity
// var credential = new DefaultAzureCredential(
//     new DefaultAzureCredentialOptions
//     {
//         ManagedIdentityClientId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTID");
//     });

// service principal 
// var tenantId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_TENANTID");
// var clientId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTID");
// var clientSecret = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTSECRET");
// var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);

var blobServiceClient = new BlobServiceClient(
        new Uri(blobEndpoint),
        credential);

Java

1. Add the following dependencies in your pom.xml file:

   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-storage-blob</artifactId>
   </dependency>
   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
       <version>1.1.5</version>
   </dependency>
   

2. Authenticate using azure-identity and get the endpoint URL from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   String url = System.getenv("AZURE_STORAGEBLOB_RESOURCEENDPOINT");  
   
   // Uncomment the following lines according to the authentication type.
   // for system managed identity
   // DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder().build();
   
   // for user assigned managed identity
   // DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder()
   //     .managedIdentityClientId(System.getenv("AZURE_STORAGEBLOB_CLIENTID"))
   //     .build();
   
   // for service principal
   // ClientSecretCredential defaultCredential = new ClientSecretCredentialBuilder()
   //   .clientId(System.getenv("<AZURE_STORAGEBLOB_CLIENTID>"))
   //   .clientSecret(System.getenv("<AZURE_STORAGEBLOB_CLIENTSECRET>"))
   //   .tenantId(System.getenv("<AZURE_STORAGEBLOB_TENANTID>"))
   //   .build();
   
   BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
       .endpoint(url)
       .credential(defaultCredential)
       .buildClient();
   

springBoot

Authentication type is not supported for Spring Boot.

Python

1. Install dependencies

   pip install azure-identity
   pip install azure-storage-blob
   

2. Authenticate using azure-identity library and get the endpoint URL from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   from azure.identity import ManagedIdentityCredential, ClientSecretCredential
   from azure.storage.blob import BlobServiceClient
   import os
   
   account_url = os.getenv('AZURE_STORAGEBLOB_RESOURCEENDPOINT')
   
   # Uncomment the following lines according to the authentication type.
   # system assigned managed identity
   # cred = ManagedIdentityCredential()
   
   # user assigned managed identity
   # managed_identity_client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # cred = ManagedIdentityCredential(client_id=managed_identity_client_id)
   
   # service principal
   # tenant_id = os.getenv('AZURE_STORAGEBLOB_TENANTID')
   # client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # client_secret = os.getenv('AZURE_STORAGEBLOB_CLIENTSECRET')
   # cred = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret) 
   
   blob_service_client = BlobServiceClient(account_url, credential=cred)
   

Django

1. Install dependencies.

   pip install azure-identity
   pip install django-storages[azure]
   

2. Authenticate via azure-identity library. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   from azure.identity import ManagedIdentityCredential, ClientSecretCredential
   import os
   
   # Uncomment the following lines according to the authentication type.
   # system assigned managed identity
   # cred = ManagedIdentityCredential()
   
   # user assigned managed identity
   # managed_identity_client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # cred = ManagedIdentityCredential(client_id=managed_identity_client_id)
   
   # service principal
   # tenant_id = os.getenv('AZURE_STORAGEBLOB_TENANTID')
   # client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # client_secret = os.getenv('AZURE_STORAGEBLOB_CLIENTSECRET')
   # cred = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)
   

3. In setting file, add following lines. For more information, see django-storages[azure].

   # in your setting file, eg. settings.py
   AZURE_CUSTOM_DOMAIN = os.getenv('AZURE_STORAGEBLOB_RESOURCEENDPOINT')
   AZURE_ACCOUNT_NAME = AZURE_CUSTOM_DOMAIN.split('.')[0].removeprefix('https://')    
   AZURE_TOKEN_CREDENTIAL = cred # this is the cred acquired from above step.
   
   

Go

1. Install dependencies.

   go get "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
   go get "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   

2. In code, authenticate via azidentity library. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   import (
     "context"
   
     "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
     "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   )
   
   
   func main() {
   
     account_endpoint = os.Getenv("AZURE_STORAGEBLOB_RESOURCEENDPOINT")
   
     // Uncomment the following lines according to the authentication type.
     // for system-assigned managed identity
     // cred, err := azidentity.NewDefaultAzureCredential(nil)
   
     // for user-assigned managed identity
     // clientid := os.Getenv("AZURE_STORAGEBLOB_CLIENTID")
     // azidentity.ManagedIdentityCredentialOptions.ID := clientid
     // options := &azidentity.ManagedIdentityCredentialOptions{ID: clientid}
     // cred, err := azidentity.NewManagedIdentityCredential(options)
   
     // for service principal
     // clientid := os.Getenv("AZURE_STORAGEBLOB_CLIENTID")
     // tenantid := os.Getenv("AZURE_STORAGEBLOB_TENANTID")
     // clientsecret := os.Getenv("AZURE_STORAGEBLOB_CLIENTSECRET")
     // cred, err := azidentity.NewClientSecretCredential(tenantid, clientid, clientsecret, &azidentity.ClientSecretCredentialOptions{})
   
     if err != nil {
       // error handling
     }
   
     client, err := azblob.NewBlobServiceClient(account_endpoint, cred, nil)
   }
   

NodeJS

1. Install dependencies

   npm install --save @azure/identity
   npm install @azure/storage-blob
   

2. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. Authenticate via @azure/identity library. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   import { DefaultAzureCredential,ClientSecretCredential } from "@azure/identity";
   
   const { BlobServiceClient } = require("@azure/storage-blob");
   
   const account_url = process.env.AZURE_STORAGEBLOB_RESOURCEENDPOINT;
   
   // Uncomment the following lines according to the authentication type.
   // for system assigned managed identity
   // const credential = new DefaultAzureCredential();
   
   // for user assigned managed identity
   // const clientId = process.env.AZURE_STORAGEBLOB_CLIENTID;
   // const credential = new DefaultAzureCredential({
   //     managedIdentityClientId: clientId
   // });
   
   // for service principal
   // const tenantId = process.env.AZURE_STORAGEBLOB_TENANTID;
   // const clientId = process.env.AZURE_STORAGEBLOB_CLIENTID;
   // const clientSecret = process.env.AZURE_STORAGEBLOB_CLIENTSECRET;
   // const credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
   
   const blobServiceClient = new BlobServiceClient(account_url, credential);
   

Other

For other languages, you can use the Azure Blob Storage account url and other properties that Service Connector sets to the environment variables to connect to Azure Blob storage. For environment variable details, see Integrate Azure Blob Storage with Service Connector.

Connection string

For default environment variables and sample code of other authentication type, please choose from beginning of the documentation.

SpringBoot client type

Application properties	Description	Example value
azure.storage.account-name	Your Blob storage-account-name	<storage-account-name>
azure.storage.account-key	Your Blob Storage account key	<account-key>
azure.storage.blob-endpoint	Your Blob Storage endpoint	https://<storage-account-name>.blob.core.windows.net/
spring.cloud.azure.storage.blob.account-name	Your Blob storage-account-name for Spring Cloud Azure version 4.0 or above	<storage-account-name>
spring.cloud.azure.storage.blob.account-key	Your Blob Storage account key for Spring Cloud Azure version 4.0 or above	<account-key>
spring.cloud.azure.storage.blob.endpoint	Your Blob Storage endpoint for Spring Cloud Azure version 4.0 or above	https://<storage-account-name>.blob.core.windows.net/

Other client types

Default environment variable name	Description	Example value
AZURE_STORAGEBLOB_CONNECTIONSTRING	Blob Storage connection string	DefaultEndpointsProtocol=https;AccountName=<account name>;AccountKey=<account-key>;EndpointSuffix=core.windows.net

Sample code

Refer to the steps and code below to connect to Azure Blob Storage using a connection string.

.NET

Get the Azure Blob Storage connection string from the environment variable added by Service Connector.

Install dependencies

dotnet add package Azure.Storage.Blob

using Azure.Storage.Blobs;
using Azure.Storage.Blobs.Models;
using System; 

// get Blob connection string
var connectionString = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CONNECTIONSTRING");

// Create a BlobServiceClient object 
var blobServiceClient = new BlobServiceClient(connectionString);

Java

1. Add the following dependencies in your pom.xml file:

   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-storage-blob</artifactId>
   </dependency>
   

2. Get the connection string from the environment variable to connect to Azure Blob Storage:

   String connectionStr = System.getenv("AZURE_STORAGEBLOB_CONNECTIONSTRING");
   BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
       .connectionString(connectionStr)
       .buildClient();
   

springBoot

Refer to Upload a file to an Azure Blob Storage and set up your Spring application. The configuration properties are added to Spring Apps by Service Connector. Two sets of configuration properties are provided according to the version of Spring Cloud Azure (below 4.0 and above 4.0). For more information about library changes of Spring Cloud Azure, refer to Spring Cloud Azure Migration Guide.

Python

1. Install dependencies

   pip install azure-storage-blob
   

2. Get the Azure Blob Storage connection string from the environment variable added by Service Connector.

   from azure.storage.blob import BlobServiceClient
   import os
   
   connection_str = os.getenv('AZURE_STORAGEBLOB_CONNECTIONSTRING')
   
   blob_service_client = BlobServiceClient.from_connection_string(connection_str)
   

Django

1. Install dependencies.

   pip install django-storages[azure]
   

2. Configure and set up the Azure Blob Storage backend in your Django settings file accordingly to your django version. For more information, see django-storages[azure].

3. In setting file, add following lines.

   # in your setting file, eg. settings.py
   AZURE_CONNECTION_STRING = os.getenv('AZURE_STORAGEBLOB_CONNECTIONSTRING')
   
   

Go

1. Install dependencies.

   go get "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   

2. Get the Azure Blob Storage connection string from the environment variable added by Service Connector.

   import (
     "context"
   
     "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   )
   
   
   func main() {
   
     connection_str = os.LookupEnv("AZURE_STORAGEBLOB_CONNECTIONSTRING")     
     client, err := azblob.NewClientFromConnectionString(connection_str, nil);
   }
   

NodeJS

1. Install dependencies

   npm install @azure/storage-blob
   

2. Get the Azure Blob Storage connection string from the environment variable added by Service Connector.

   const { BlobServiceClient } = require("@azure/storage-blob");
   
   const connection_str = process.env.AZURE_STORAGEBLOB_CONNECTIONSTRING;
   const blobServiceClient = BlobServiceClient.fromConnectionString(connection_str);
   

Other

For other languages, you can use the Azure Blob Storage account url and other properties that Service Connector sets to the environment variables to connect to Azure Blob Storage. For environment variable details, see Integrate Azure Blob Storage with Service Connector.

Service principal

For default environment variables and sample code of other authentication type, please choose from beginning of the documentation.

Default environment variable name	Description	Example value
AZURE_STORAGEBLOB_RESOURCEENDPOINT	Blob Storage endpoint	https://<storage-account-name>.blob.core.windows.net/
AZURE_STORAGEBLOB_CLIENTID	Your client ID	<client-ID>
AZURE_STORAGEBLOB_CLIENTSECRET	Your client secret	<client-secret>
AZURE_STORAGEBLOB_TENANTID	Your tenant ID	<tenant-ID>

Sample code

Refer to the steps and code below to connect to Azure Blob Storage using a service principal.

.NET

You can use azure-identity to authenticate via managed identity or service principal. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

Install dependencies

dotnet add package Azure.Identity

Here's sample code to connect to Blob storage using managed identity or service principal.

using Azure.Identity;
using Azure.Storage.Blobs;

// get Blob endpoint
var blobEndpoint = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_RESOURCEENDPOINT");

// Uncomment the following lines according to the authentication type.
// system-assigned managed identity
// var credential = new DefaultAzureCredential();

// user-assigned managed identity
// var credential = new DefaultAzureCredential(
//     new DefaultAzureCredentialOptions
//     {
//         ManagedIdentityClientId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTID");
//     });

// service principal 
// var tenantId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_TENANTID");
// var clientId = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTID");
// var clientSecret = Environment.GetEnvironmentVariable("AZURE_STORAGEBLOB_CLIENTSECRET");
// var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);

var blobServiceClient = new BlobServiceClient(
        new Uri(blobEndpoint),
        credential);

Java

1. Add the following dependencies in your pom.xml file:

   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-storage-blob</artifactId>
   </dependency>
   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
       <version>1.1.5</version>
   </dependency>
   

2. Authenticate using azure-identity and get the endpoint URL from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   String url = System.getenv("AZURE_STORAGEBLOB_RESOURCEENDPOINT");  
   
   // Uncomment the following lines according to the authentication type.
   // for system managed identity
   // DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder().build();
   
   // for user assigned managed identity
   // DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder()
   //     .managedIdentityClientId(System.getenv("AZURE_STORAGEBLOB_CLIENTID"))
   //     .build();
   
   // for service principal
   // ClientSecretCredential defaultCredential = new ClientSecretCredentialBuilder()
   //   .clientId(System.getenv("<AZURE_STORAGEBLOB_CLIENTID>"))
   //   .clientSecret(System.getenv("<AZURE_STORAGEBLOB_CLIENTSECRET>"))
   //   .tenantId(System.getenv("<AZURE_STORAGEBLOB_TENANTID>"))
   //   .build();
   
   BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
       .endpoint(url)
       .credential(defaultCredential)
       .buildClient();
   

springBoot

Authentication type is not supported for Spring Boot.

Python

1. Install dependencies

   pip install azure-identity
   pip install azure-storage-blob
   

2. Authenticate using azure-identity library and get the endpoint URL from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   from azure.identity import ManagedIdentityCredential, ClientSecretCredential
   from azure.storage.blob import BlobServiceClient
   import os
   
   account_url = os.getenv('AZURE_STORAGEBLOB_RESOURCEENDPOINT')
   
   # Uncomment the following lines according to the authentication type.
   # system assigned managed identity
   # cred = ManagedIdentityCredential()
   
   # user assigned managed identity
   # managed_identity_client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # cred = ManagedIdentityCredential(client_id=managed_identity_client_id)
   
   # service principal
   # tenant_id = os.getenv('AZURE_STORAGEBLOB_TENANTID')
   # client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # client_secret = os.getenv('AZURE_STORAGEBLOB_CLIENTSECRET')
   # cred = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret) 
   
   blob_service_client = BlobServiceClient(account_url, credential=cred)
   

Django

1. Install dependencies.

   pip install azure-identity
   pip install django-storages[azure]
   

2. Authenticate via azure-identity library. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   from azure.identity import ManagedIdentityCredential, ClientSecretCredential
   import os
   
   # Uncomment the following lines according to the authentication type.
   # system assigned managed identity
   # cred = ManagedIdentityCredential()
   
   # user assigned managed identity
   # managed_identity_client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # cred = ManagedIdentityCredential(client_id=managed_identity_client_id)
   
   # service principal
   # tenant_id = os.getenv('AZURE_STORAGEBLOB_TENANTID')
   # client_id = os.getenv('AZURE_STORAGEBLOB_CLIENTID')
   # client_secret = os.getenv('AZURE_STORAGEBLOB_CLIENTSECRET')
   # cred = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)
   

3. In setting file, add following lines. For more information, see django-storages[azure].

   # in your setting file, eg. settings.py
   AZURE_CUSTOM_DOMAIN = os.getenv('AZURE_STORAGEBLOB_RESOURCEENDPOINT')
   AZURE_ACCOUNT_NAME = AZURE_CUSTOM_DOMAIN.split('.')[0].removeprefix('https://')    
   AZURE_TOKEN_CREDENTIAL = cred # this is the cred acquired from above step.
   
   

Go

1. Install dependencies.

   go get "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
   go get "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   

2. In code, authenticate via azidentity library. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   import (
     "context"
   
     "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
     "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
   )
   
   
   func main() {
   
     account_endpoint = os.Getenv("AZURE_STORAGEBLOB_RESOURCEENDPOINT")
   
     // Uncomment the following lines according to the authentication type.
     // for system-assigned managed identity
     // cred, err := azidentity.NewDefaultAzureCredential(nil)
   
     // for user-assigned managed identity
     // clientid := os.Getenv("AZURE_STORAGEBLOB_CLIENTID")
     // azidentity.ManagedIdentityCredentialOptions.ID := clientid
     // options := &azidentity.ManagedIdentityCredentialOptions{ID: clientid}
     // cred, err := azidentity.NewManagedIdentityCredential(options)
   
     // for service principal
     // clientid := os.Getenv("AZURE_STORAGEBLOB_CLIENTID")
     // tenantid := os.Getenv("AZURE_STORAGEBLOB_TENANTID")
     // clientsecret := os.Getenv("AZURE_STORAGEBLOB_CLIENTSECRET")
     // cred, err := azidentity.NewClientSecretCredential(tenantid, clientid, clientsecret, &azidentity.ClientSecretCredentialOptions{})
   
     if err != nil {
       // error handling
     }
   
     client, err := azblob.NewBlobServiceClient(account_endpoint, cred, nil)
   }
   

NodeJS

1. Install dependencies

   npm install --save @azure/identity
   npm install @azure/storage-blob
   

2. Get the Azure Blob Storage endpoint url from the environment variable added by Service Connector. Authenticate via @azure/identity library. When using the code below, uncomment the part of the code snippet for the authentication type you want to use.

   import { DefaultAzureCredential,ClientSecretCredential } from "@azure/identity";
   
   const { BlobServiceClient } = require("@azure/storage-blob");
   
   const account_url = process.env.AZURE_STORAGEBLOB_RESOURCEENDPOINT;
   
   // Uncomment the following lines according to the authentication type.
   // for system assigned managed identity
   // const credential = new DefaultAzureCredential();
   
   // for user assigned managed identity
   // const clientId = process.env.AZURE_STORAGEBLOB_CLIENTID;
   // const credential = new DefaultAzureCredential({
   //     managedIdentityClientId: clientId
   // });
   
   // for service principal
   // const tenantId = process.env.AZURE_STORAGEBLOB_TENANTID;
   // const clientId = process.env.AZURE_STORAGEBLOB_CLIENTID;
   // const clientSecret = process.env.AZURE_STORAGEBLOB_CLIENTSECRET;
   // const credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
   
   const blobServiceClient = new BlobServiceClient(account_url, credential);
   

Other

For other languages, you can use the Azure Blob Storage account url and other properties that Service Connector sets to the environment variables to connect to Azure Blob storage. For environment variable details, see Integrate Azure Blob Storage with Service Connector.

Next steps

Follow the tutorials to learn more about Service Connector.

Learn about Service Connector concepts