Azure Blob Storage Connector
Object storage on Microsoft Azure.
What it lets you do
- List your containers.
- List blobs in a container.
- Download a blob as a file.
- Upload a file as a blob.
- Delete a blob.
- Inspect blob metadata.
Connection form
You authenticate with EITHER a connection string OR an account name plus account key (not both).
| Field |
Required |
Sensitive |
When to use |
| Connection String |
One of |
Yes |
Easiest — pasteable from the Azure portal |
| Account Name |
One of |
Yes |
Used with Account Key auth |
| Account Key |
One of |
Yes |
Used with Account Name auth |
Both methods are stored encrypted. Pick whichever your team standard prefers — the connector behaves identically.
Setting up credentials
Option A — Connection string (easiest)
- Open the Azure portal and navigate to your Storage Account.
- In the left nav, open Security + networking → Access keys.
- Click Show keys.
- Copy either of the Connection string values.
- In DagFlux, paste it into the Connection String field. Leave account name and key empty.
Option B — Account name and key
- Same starting point — Storage Account → Access keys.
- Note the Storage account name at the top.
- Copy one of the Key values.
- In DagFlux, fill Account Name and Account Key. Leave connection string empty.
Option C — Use a least-privilege approach (recommended for production)
The two options above grant full control over the storage account. For least-privilege access, use Azure AD role assignments or a shared access signature (SAS):
- In the storage account, open Access Control (IAM).
- Click Add → Add role assignment.
- Assign one of:
- Storage Blob Data Contributor — read + write objects.
- Storage Blob Data Reader — read-only.
- Assign the role to a service principal you've created (or to a user account you can sign in with).
- Use the service principal's connection string format (
DefaultEndpointsProtocol=https;AccountName=…;AuthType=AAD;…) in DagFlux.
Alternatively, you can constrain access using a SAS token attached to a connection string — the Azure portal can generate this under Shared access signature with read / write / list permissions limited to the containers you choose and an expiry time of your choosing.
Behaviour notes
- Listings use a forward-slash delimiter, so virtual folders inside a container appear as their own entries.
- The connector chooses between connection string and account name/key automatically based on which fields you filled in.
