Azure Blob Storage OAuth 2.0 (Entra ID) connector profile – StackOne setup guide

Sign in to the Microsoft Entra admin center with an account that has at least the Application Developer role.

• If you manage more than one tenant, confirm you are in the correct directory using the Settings (gear) icon before continuing.

In the left sidebar, go to Entra ID > App registrations. On the App registrations page, click New registration and complete the Register an application form.

• Name: enter a name you will recognise, for example StackOne Azure Blob Storage.
• Under Supported account types, select the single-tenant option — shown as Single tenant only in the current portal, or Accounts in this organizational directory only (single tenant) in the classic form.
• Leave Redirect URI (optional) empty for now — you will add it in the next section.
• Click Register.

After registration you land on the app’s Overview page. From the Essentials panel, copy these two values and store them securely:

• Application (client) ID — the public identifier of your app. Paste it into the Client ID field in the StackOne Connector profile.
• Directory (tenant) ID — your Microsoft Entra tenant identifier. Paste it into the Tenant ID field in the StackOne Connector profile.

In the app’s left menu, open Authentication (Preview). On the Redirect URI configuration tab, click Add Redirect URI, then under Web applications choose Web.

• In the Redirect URI field, enter StackOne’s callback URL exactly: https://api.stackone.com/connect/oauth2/azureblobstorage/callback
• Click Configure to save.
• If your portal shows the older Authentication page instead of the Preview experience, under Platform configurations click Add a platform, select Web, enter the same URL, and click Configure.

In the app’s left menu, open API permissions, click Add a permission, then select Azure Storage.

• Choose Delegated permissions.
• Select user_impersonation (Access Azure Storage).
• Click Add permissions.
• You do not need to add offline_access here — StackOne requests it automatically during sign-in to obtain refresh tokens, and it requires no Entra ID configuration.

Back on the API permissions page, click Grant admin consent for [your tenant] and confirm with Yes. The user_impersonation permission should then show a green Granted status.

• Admin consent must be granted by a Global Administrator or Privileged Role Administrator.

In the app’s left menu, open Certificates & secrets, stay on the Client secrets tab, and click New client secret.

• Enter a Description, for example StackOne Integration.
• Choose an expiry under Expires (for example the recommended 180 days).
• Click Add.

Copy the secret’s Value immediately and paste it into the Client Secret field in the StackOne Connector profile.

• The Value is shown only once and cannot be retrieved after you leave this page — copy it now. Do not copy the Secret ID, which is a different value.
• The Scopes field in the StackOne Connector profile is optional. Leave it empty to use the defaults (https://storage.azure.com/user_impersonation and offline_access); only set it if you need to request different scopes.

In the Azure portal, search for Storage accounts in the top search bar and select the storage account you want to connect. Then select Access Control (IAM) in the left sidebar and click Add > Add role assignment.

• On the Role tab, under Job function roles, search for and select Storage Blob Data Contributor — it grants read, write, and delete access to blobs and containers, which covers most StackOne actions. Then click Next.
• On the Members tab, keep Assign access to set to User, group, or service principal, click Select members, and choose the user who will connect StackOne.
• Click Review + assign to finish.
• If StackOne will use blob tag actions (Get Blob Tags, Set Blob Tags, Find Blobs By Tags), assign Storage Blob Data Owner instead — it is a superset of Storage Blob Data Contributor.