Azure blob storage

This connection authenticates with a shared access signature (SAS) token scoped to the container you want to read from. The token grants read and list access only, and you can set an expiry date and revoke it at any time from your storage account settings.

Files do not need to contain a timestamp column for change tracking. When the data to sync is configured, the object’s last modified time, as recorded by the storage provider, will be available as a column.

Step 1: create an access token

Open the storage account

In the Azure portal, navigate to the Storage accounts service and click the account that contains the container you want to read from. Make a note of the storage account name and the container name.

Open the shared access signature settings

In the navigation pane, under “Security + networking”, click Shared access signature.

Configure the token permissions

Update the required accessible services and permissions:

Under “Allowed services”, select Blob.
Under “Allowed resource types”, select Container and Object.
Under “Allowed permissions”, select Read and List.

Generate the token

Select a “Start and expiry date/time” based on your security posture (for example, set the expiration date 6 months into the future), and click Generate SAS and connection string. Make a note of the SAS token that is generated.

If you limit network access on the storage account, add the static IP to the allowed address range so we can reach the container. Reach out to your account representative for the static IP address to use.

Step 2: submit your connection details

Provide the following details to complete the source setup:

The name is a descriptive name of the source.
The storage account name from Step 1.
The container name from Step 1.
The Storage account SAS token from Step 1.

Terraform

If your organization manages infrastructure with Terraform, you can use the configuration below instead of the steps above. It generates the same SAS token and creates nothing in your account.

Use the official hashicorp/azurerm provider, version 4.9 or later. Your provider configuration needs a features {} block. Your Azure credentials need permission to list the storage account’s access keys, and the storage account must allow storage account key access.
In terraform.tfvars, set storage_account_name, resource_group_name, container_name, sas_start, and sas_expiry (RFC 3339 timestamps; the expiry must be in the future).
After terraform apply, use the storage_account_name, container_name, and sas_token outputs to complete the connection setup. Print each with terraform output -raw <name>.

variable "storage_account_name" {
  type        = string
  description = "Existing storage account that holds the container to read from."
}

variable "resource_group_name" {
  type        = string
  description = "Resource group of the storage account."
}

variable "container_name" {
  type        = string
  description = "Existing container to read from."
}

variable "sas_start" {
  type        = string
  description = "SAS token start time, RFC 3339 (e.g. 2026-01-01T00:00:00Z)."
}

variable "sas_expiry" {
  type        = string
  description = "SAS token expiry time, RFC 3339 (e.g. six months after sas_start)."
}

data "azurerm_storage_account" "source" {
  name                = var.storage_account_name
  resource_group_name = var.resource_group_name
}

data "azurerm_storage_account_sas" "read" {
  connection_string = data.azurerm_storage_account.source.primary_connection_string
  https_only        = true
  start             = var.sas_start
  expiry            = var.sas_expiry

  services {
    blob  = true
    file  = false
    queue = false
    table = false
  }
  resource_types {
    service   = false
    container = true
    object    = true
  }
  permissions {
    read    = true
    list    = true
    write   = false
    add     = false
    create  = false
    delete  = false
    update  = false
    process = false
    tag     = false
    filter  = false
  }
}

output "storage_account_name" {
  value = data.azurerm_storage_account.source.name
}

output "container_name" {
  value = var.container_name
}

output "sas_token" {
  value     = trimprefix(data.azurerm_storage_account_sas.read.sas, "?")
  sensitive = true
}

storage_account_name = "mycompanytransfers01"
resource_group_name  = "my-resource-group"
container_name       = "my-container"
sas_start            = "<start time, RFC 3339>"
sas_expiry           = "<expiry time in the future, RFC 3339>"

Getting started

Core concepts

Features

Logging, Monitoring, and Observability

Sources

Security & compliance

Developer SDKs

Azure blob storage

Step 1: create an access token

Step 2: submit your connection details

Terraform

​Step 1: create an access token

​Step 2: submit your connection details

​Terraform

Step 1: create an access token

Step 2: submit your connection details

Terraform