# Azure Blob Storage

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34980988483085/ext-e8898c6f4c.png)
**Azure Blob Storage** is Microsoft's cloud-based object storage solution, optimized for storing massive amounts of unstructured data, like text or binary data.

You will need a **SAS token**. To create one, visit the section *Create SAS tokens with Azure Storage Explorer* under the following article: [Create SAS tokens for your storage containers](https://learn.microsoft.com/en-us/azure/ai-services/translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers#create-sas-tokens-with-azure-storage-explorer)

Please note there's no need to append the SAS token, just copy it to be pasted in the following step-by-step instructions.

### The SAS token expires — plan for it

Azure Blob Storage has one method, **Shared Access Signature**, taking the
**Storage Account Name** and a **SAS token**. A SAS token carries a hard expiry
date, so this connection *will* stop working on a date you choose when you create
it. Two things follow:

- Give the token an expiry you are willing to manage, and record it in the
  connection's **Credentials expiry** field — Relyance will then warn you before
  it lapses rather than after.
- Grant it read and list on the containers in scope, nothing more. A token that
  can write is not needed for scanning.

Scope the scan with **Container and Prefixes**; left empty, every container the
token can reach is in scope.

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Azure Blob Storage** integration card and click on it.
5. Click on the **Add Connection** button on the top right
6. Provide a meaningful name for the integration and click on the **Add** button
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scopes** **and** **Permissions**, and **Endpoints** details and click on **Continue**. For more details, see [Integration Features](/docs/introduction-to-relyance-ai/integration-features/)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34980988483085/34982233876365.png)

8. In the Connection section, provide the appropriate values and click on Continue.
    - **Connection Name:** This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual Maps**, **Assets**, and **Data Flow** **Analysis** pages.
    - **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    - **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/).
9. In the **Authentication** section, Choose **Shared Access Signature** under **Authentication Method**. (it is the only method Azure Blob Storage offers), then paste the **Storage Account Name** and **SAS token** retrieved from the previous step-by-step.
    - **Container and Prefixes** (optional) scopes the scan. Left empty, every container the token can reach is in scope:

      ```json
      [
        {
          "container": "",
          "prefixes": []
        }
      ]
      ```
10. Review the configuration summary from the **Completion** section and click on **Finish**.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34980988483085/34982188833037.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34980988483085/34982233886221.png)

![Screenshot 2025-06-25 194915.png](https://assets.relyanceuat.xyz/images/docs/34980988483085/37612380317581.png)

11. Confirm the integration **Status** reflects **Connected**.

### Verify the connection is really working

When you generate the SAS, Relyance needs all of these boxes ticked. They are easy
to under-select, and each omission fails differently:

| Setting | Required value | What breaks without it |
| --- | --- | --- |
| Allowed services | **Blob** | nothing works — the token is not valid for blob endpoints |
| Allowed resource types | **Service** | the account's containers cannot be enumerated, so the scan finds nothing at all |
| Allowed resource types | **Container** | container-level listing fails |
| Allowed resource types | **Object** | blobs are listed but never read, so nothing is classified |
| Allowed permissions | **Read** and **List** | Read alone cannot enumerate; List alone cannot fetch content |

1. **Connected but nothing discovered** is nearly always the **Service** resource
   type left unticked. It is the box people miss, because Container and Object read
   like the complete set.
2. **Containers listed, nothing classified** is the **Object** resource type, or
   **Read** without **List** — the same listing-versus-reading split that shows up
   on S3 and GCS.
3. **A connection that worked for months and then stopped** is the token expiring.
   That is expected behaviour, not a fault: see the section above and set the
   **Credentials expiry** field so the warning arrives first.
4. **Fewer containers than expected.** **Container and Prefixes** is the scope;
   left empty every container the token can reach is scanned.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "azure_blobstorage" {
  vendor = "azure_blobstorage"
  name   = "<your connection name>"

  auth = {
    method = "access-token"
    params = {
      account_name = "<account_name>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      sas_token = var.azure_blobstorage_sas_token
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->