Azure Blob
Register Azure Blob (or OneLake) with an access key, SAS, service principal, managed identity, or a linked identity.
Register an Azure Blob container (or Microsoft Fabric / OneLake) as a storage connection. Azure supports several auth modes - provide exactly one.
Auth modes
| Mode | Fields | Notes |
|---|---|---|
| Access key | access_key | Storage account key. |
| SAS token | sas_token | Shared Access Signature. |
| Service principal | client_id + client_secret + tenant_id | Works on any deployment; self-refreshes. |
| Managed identity | use_msi (+ optional client_id for user-assigned) | Only when Eddytor runs on Azure infra (AKS/VM/ACI) - fetches tokens from Azure IMDS. |
| Bearer / delegated | (omit all auth) | Uses the caller's linked Azure identity via the per-org OAuth app. |
Config name is {account_name}-{container}. Service principal and managed
identity refresh tokens internally - no linked-identity needed.
Register
The CLI supports all the auth modes - pass exactly one:
# access key
eddytor create storage azure --account-name acme --container mdm --access-key "$AZ_KEY"
# SAS token
eddytor create storage azure --account-name acme --container mdm --sas-token "$AZ_SAS"
# service principal
eddytor create storage azure --account-name acme --container mdm \
--client-id "$CLIENT_ID" --client-secret "$CLIENT_SECRET" --tenant-id "$TENANT_ID"
# managed identity (only on Azure infra)
eddytor create storage azure --account-name acme --container mdm --use-msiPOST /v1/storages/az
Authorization: Bearer edd_live_…
# service principal:
{ "account_name": "acme", "container": "mdm",
"client_id": "…", "client_secret": "…", "tenant_id": "…" }
# managed identity (on Azure infra):
{ "account_name": "acme", "container": "mdm", "use_msi": true }# access key
register_az_storage(account_name="acme", container="mdm", access_key="...")
# service principal
register_az_storage(account_name="acme", container="mdm",
client_id="...", client_secret="...", tenant_id="...")
# managed identity (only when Eddytor runs on Azure infra)
register_az_storage(account_name="acme", container="mdm", use_msi=true)
# Microsoft Fabric / OneLake
register_az_storage(account_name="acme", container="mdm",
access_key="...", use_fabric_endpoint=true)Microsoft Fabric / OneLake
Set use_fabric_endpoint=true alongside your auth to target OneLake instead of
standard Blob.
Gotchas
Heads up
Pass exactly one auth mode - more than one is ambiguous
and rejected. Managed identity only works on Azure infrastructure: if IMDS is
unreachable, registration fails the probe with
managed identity unavailable - not running on Azure infrastructure….Prefer service principal or managed identity over a long-lived access key. On AKS, managed identity is the cleanest - see AKS.