> For the complete documentation index, see [llms.txt](https://docs.flashback.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flashback.tech/guides/configure-external-delegated-credentials/configure-external-access-for-azure-blob.md).

# Configure Azure Blob delegated access

## What you will achieve

You will configure Azure Blob access for Flashgate using **Microsoft Entra ID + RBAC** so you can avoid long-lived storage account keys where possible.

## Azure delegated access model (practical view)

For delegated access, assign data-plane RBAC roles to the Flashgate Azure identity (guest user or service principal) at the right scope:

* **Storage account scope** when access should apply to many containers.
* **Container scope** when you want narrower least-privilege access.

{% hint style="info" %}
Use Entra ID + RBAC where possible. Account keys are broad, long-lived secrets and should be treated as fallback.
{% endhint %}

## Prerequisites

* An Azure subscription.
* A storage account and target container.
* Permissions to assign RBAC roles (for example Owner or User Access Administrator at the target scope).
* The Flashgate Azure identity identifier (guest user object ID or service principal app/object ID).
  * If you do not have it, obtain it from Flashgate support or from the Flashgate UI/documentation available in your organization.

## Step-by-step (Azure Portal)

{% stepper %}
{% step %}

#### Identify the target scope

Choose where to assign permissions:

* **Storage account**: broader scope, easier operations.
* **Container**: tighter least-privilege boundary (recommended when only specific containers are needed).

In Azure Portal, open your Storage Account, then either:

* stay at storage account level, or
* open **Data storage → Containers → *****your-container*** for container-level scope.
  {% endstep %}

{% step %}

#### Add role assignment for Flashgate identity

1. Open **Access control (IAM)** on the selected scope.
2. Click **Add → Add role assignment**.
3. Select a minimum role based on required operations:
   * **Storage Blob Data Reader** (read-only)
   * **Storage Blob Data Contributor** (read/write/delete for blob data)
4. Assign access to the Flashgate Azure identity (guest user or service principal).
5. Save the assignment.

{% hint style="warning" %}
Use the smallest role that satisfies your workflow. Avoid account-wide roles if container-level access is enough.
{% endhint %}
{% endstep %}

{% step %}

#### (Optional) Review network restrictions

If your storage account uses firewalls, private endpoints, or restricted networks, ensure Flashgate traffic can reach Azure Blob endpoints.

Delegated IAM permissions alone do not bypass network controls.
{% endstep %}

{% step %}

#### Configure the bucket in Flashgate

In Flashgate, follow [Configure a Bucket](/guides/setup-the-cloud-and-ai-gateway/start-with-cloud-storage/create-a-bucket.md) and select:

* **Storage Type**: `Azure Blob`
* **Storage Account**: your Azure storage account name
* **Container**: your target container
* **Access Key**: may be left blank for delegated guest access when supported by your product flow (as documented in the bucket configuration guide)
  {% endstep %}

{% step %}

#### Validate access

After saving, run a basic repository validation:

* attach the bucket to a repository,
* perform a simple read/write test according to your role,
* verify expected success/failure behavior.

If your workspace has a dedicated validation flow, use that flow first.
{% endstep %}
{% endstepper %}

## Troubleshooting

* **RBAC changes seem ignored**: role propagation can take several minutes.
* **Wrong scope assigned**: confirm the role is assigned at the correct container or storage-account scope.
* **Role mismatch**: ensure you granted a **data-plane** blob role (for example Storage Blob Data Reader/Contributor), not only management-plane permissions.
* **Guest account restrictions**: some tenants restrict B2B/guest permissions; verify tenant policies for external principals.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.flashback.tech/guides/configure-external-delegated-credentials/configure-external-access-for-azure-blob.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.