> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.instabase.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.instabase.com/_mcp/server. # Connecting Azure Blob Storage > Add Azure Blob Storage as a data connection. Users with workspace manager permissions or higher can connect Azure Blob Storage containers to AI Hub. ## About this connection Review the following functionality, limitations, and other considerations when connecting an Azure Blob Storage container. * **Functionality** -- Connected Azure Blob Storage containers are supported for use as a source of input files, a destination for file output, and as an upstream or downstream integration in deployments. Azure Blob Storage containers can also be used as [default drives](/admin/data-sources/default-drives/). * **Authentication** -- AI Hub supports three authentication methods for Azure Blob Storage containers: connection strings, service principals, and managed identities. * **Supported content** -- Any [supported file types](/overview/limitations/). ## Connecting Azure Blob Storage You can connect your Azure Blob Storage container using the following authentication methods: * [Connection string](#authenticating-with-a-connection-string) * [Service principal](#authenticating-with-a-service-principal) * [Managed identity](#authenticating-with-a-managed-identity) ### Authenticating with a connection string 1. In Workspaces, select a workspace to connect the drive to, then select the **Data** tab. 2. Click **Add data source**, then select **Azure Blob Storage**. 3. Select an audience. * **Workspace members** (Recommended) -- Connect the drive to the selected workspace. Only members of the selected workspace have access. * **Organization members** -- Connect the drive at the organization level, making it available to all workspaces. 4. On the configuration screen, fill in your authentication and container details, then click **Next**. 5. Enter a display name for the drive. This name can't be changed later. 6. Fill in your authentication and container details, then click **Next**. | Setting | Required | Description | | ----------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------- | | Name your drive | Required | A display name for the connected drive. This name can't be changed later. | | Container name | Required | The name of your Azure Blob Storage container. | | Auth method | Required | The authentication method to use when connecting to your storage. | | Connection string | Visible and required when **Auth method** is set to **Connection string**. | The connection string for your Azure storage account. | 7. Select whether to set the drive as a default drive. Not usually recommended, see [Managing default drives](/admin/data-sources/default-drives/) for details. 8. Click **Done** ### Authenticating with a service principal > **Before you begin** > > The service principal must have the required permissions to access and perform file operations on your storage container. Assign the [*Storage Blob Data Contributor*](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-blob-data-contributor) role. 1. In Workspaces, select a workspace to connect the drive to, then select the **Data** tab. 2. Click **Add data source**, then select **Azure Blob Storage**. 3. Select an audience. * **Workspace members** (Recommended) -- Connect the drive to the selected workspace. Only members of the selected workspace have access. * **Organization members** -- Connect the drive at the organization level, making it available to all workspaces. 4. Enter a display name for the drive. This name can't be changed later. 5. Fill in your authentication and container details, then click **Next**. | Setting | Required | Description | | -------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Container name | Required | The name of your Azure Blob Storage container. | | Auth method | Required | The authentication method to use when connecting to your storage. | | Service URL | Visible and required when **Auth method** is set to **Service principal**. | The endpoint for the Blob Service registered to the container's storage account, such as `https://.blob.core.windows.net/`. | | Tenant ID | Visible and required when **Auth method** is set to **Service principal**. | The tenant ID for the service principal. | | Client ID | Visible and required when **Auth method** is set to **Service principal**. | The client ID for the service principal. | | Client secret | Visible and required when **Auth method** is set to **Service principal**. | The client secret for the service principal. | 6. Select whether to set the drive as a default drive. Not usually recommended, see [Managing default drives](/admin/data-sources/default-drives/) for details. 7. Click **Done** ### Authenticating with a managed identity > **Before you begin** > > To authenticate with a managed identity, ensure you've completed the following. AI Hub assumes you've created a managed identity with the required access permissions, and focuses on providing the necessary information to create a federated identity credential. > > * Create a user-assigned managed identity to which the federated identity credential can be added. For guidance, see the Microsoft Entra [Manage user-assigned managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp#create-a-user-assigned-managed-identity) documentation. > > * Ensure the managed identity has access to your storage container by assigning the managed identity the [*Storage Blob Data Contributor*](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-blob-data-contributor) role. For guidance, see the Microsoft Entra [Assign Azure roles using the Azure portal](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal) documentation. 1. In Workspaces, select a workspace to connect the drive to, then select the **Data** tab. 2. Click **Add data source**, then select **Azure Blob Storage**. 3. Select an audience. * **Workspace members** (Recommended) -- Connect the drive to the selected workspace. Only members of the selected workspace have access. * **Organization members** -- Connect the drive at the organization level, making it available to all workspaces. 4. Enter a display name for the drive. This name can't be changed later. 5. Select **Managed identity** as your authentication method. 6. Add a new managed identity or select a previously added managed identity, then click **Next**. #### Adding a managed identity 1. Click the **+** icon next to the managed identity selection dropdown. 2. Using the provided configuration details, add a federated identity credential to the user-assigned managed identity. For guidance, see the Microsoft Entra [Configure a user-assigned managed identity to trust an external identity provider](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-create-trust-user-assigned-managed-identity?pivots=identity-wif-mi-methods-azp) documentation, following the *Kubernetes accessing Azure resources* scenario. 3. Confirm the federated identity credential is added, then click **Next**. 4. Identify the managed identity: * **Managed identity display name**: A display name for the managed identity. This value doesn't need to correspond to any value in Microsoft Entra or Azure. Display names can't be changed after saving. * **Managed identity client ID**: The client ID of the user-assigned managed identity. Listed on the managed identity **Overview** page. * **Tenant ID**: The tenant ID of the Microsoft Entra ID instance. 5. Click **Next**. 7. On the configuration screen, fill in your container details, then click **Next**. | Setting | Required | Description | | -------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------- | | Storage account name | Required | The name of the Azure storage account where the container exists. | | Container name | Required | The name of your Azure Blob Storage container. | | Path to drive | Optional | A file path to a folder in the container where the desired input files are found. Leave empty to accept default (root). | 8. Select whether to set the drive as a default drive. Not usually recommended, see [Managing default drives](/admin/data-sources/default-drives/) for details. 9. Click **Done** #### Managing managed identities After adding a managed identity, it can be reused when adding other Azure Blob Storage containers. Managed identities added when connecting a workspace drive are reusable within the same workspace only. Roles added when connecting an organization drive are reusable across all workspaces. **Reusing managed identities** Previously connected managed identities display in a **Managed identity** selection dropdown when connecting Azure Blob Storage containers. When reusing a role, you don't need to add a new federated identity credential as the trust relationship is already established. **Updating managed identities** AI Hub doesn't support updating or changing the managed identity used for authentication. You can [remove](#removing-a-connection) then reconnect the container with a new managed identity. **Deleting managed identities** When you delete a role, it can no longer be used for authentication. You can't delete an IAM role that's in use with a connected drive. To continue using the connection with a different role, [remove](#removing-a-connection) then reconnect the bucket with a new role. 1. In Workspaces, select a workspace, then select the **Data** tab. 2. Click **Add data source**, then select **Azure Blob Storage**. 3. Select an audience. 4. Select **Managed identity** as your authentication method. 5. Select the managed identity to delete, then click the delete icon ![Icon of a trash can.](/_fern-img/fde5c4ebfaee103ef10fc55c5b5119885924befbf5e79ea1da8cbf46d20448a8.webp). 6. Click **Delete** to confirm. ## Updating a connection Select configuration changes are supported. * You can update the drive’s security credentials. To change the authentication method, you must remove and reconnect the drive. 1. In Workspaces, select *All workspaces*, then select the **Data** tab. 2. Click the overflow icon ![Icon with three stacked vertical dots.](/_fern-img/a83e2b40897c8c3871ed84b69fd99d990dbe0eb9bc3936ad84addb6d2ce31f95.webp) of the drive to update, then select **Modify configuration**. 3. Make any changes, then click **Update** to confirm. ## Removing a connection You can remove a connected drive to disconnect it and revoke AI Hub's access to its contents. > **Before you begin** > > Review the following limitations: > > * Removing a drive completely disconnects the drive from AI Hub. Any processed AI Hub files stored on the drive aren't deleted, but AI Hub loses the ability to reference those files in the future. While you can later reconnect the drive, doing so doesn't restore the ability to reference files previously saved to the drive. To reference such files, you must re-upload them. > > * Default drives can't be removed. For guidance on changing default drives, see [Managing default drives](/admin/data-sources/default-drives/) 1. In Workspaces, select *All workspaces*, then select the **Data** tab. 2. Click the overflow icon ![Icon with three stacked vertical dots.](/_fern-img/a83e2b40897c8c3871ed84b69fd99d990dbe0eb9bc3936ad84addb6d2ce31f95.webp) of the drive to remove, then select **Remove**. 3. Type the confirmation text, then click **Remove**.