> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Azure Blob Storage OAuth 2.0 (Entra ID) connector profile – StackOne setup guide > Set up the OAuth 2.0 (Entra ID) connector profile for Azure Blob Storage in StackOne. One-time admin setup required before your users can link Azure Blob Storage accounts via Hub. You must have at least Application Developer permissions in Microsoft Entra ID to register applications. An administrator must grant consent for the required Azure Storage API permissions.
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Register your application in Microsoft Entra ID

Register an application in Microsoft Entra ID to obtain OAuth 2.0 credentials for StackOne.

Sign in to your Microsoft Entra admin center as at least an Application Developer.

  • If you have access to multiple tenants, click the Settings (gear) icon in the top-right corner, then select the desired tenant from the list under Directory + subscription.
  • Navigate to Identity > Applications > App registrations.

Click New registration and complete the form.

  • Name: `StackOne Azure Blob Storage Integration`
  • Select Accounts in this organizational directory only (single tenant).
  • Click Register.

From the app's Overview page, copy the Application (client) ID and Directory (tenant) ID and store them securely for use later.

Configure the redirect URI

Register the OAuth 2.0 callback URL so Microsoft Entra can return the authorization code to StackOne.

Navigate to Authentication under Manage.

  • Click Add a platform and select Web.
  • Enter the redirect URI: `https://api.stackone.com/connect/oauth2/azureblobstorage/callback`
  • Click Configure.

Configure API permissions

Grant the Azure Storage delegated permission and admin consent for your application.

Enables actions: Abort Copy Blob, Copy Blob, Create Blob Snapshot, Create Container, Delete Blob, Delete Container, Download Blob, Find Blobs By Tags, Get Blob Metadata, Get Blob Properties, Get Blob Service Properties, Get Blob Tags, Get Container ACL, Get Container Metadata, Get Container Properties, List Blobs, List Containers, Set Blob Metadata, Set Blob Properties, Set Blob Service Properties, Set Blob Tags, Set Blob Tier, Set Container ACL, Set Container Metadata, Undelete Blob, Upload Blob

Navigate to API permissions under Manage.

  • Click Add a permission.
  • Select Azure Storage from the list.
  • Choose Delegated permissions.
  • Select user\_impersonation to allow access as the signed-in user.
  • Click Add permissions.

Click Grant admin consent for \[tenant name] and confirm to enable the permission for all users.

Assign Azure RBAC roles on the storage account

Entra ID authenticates the user, but Azure Storage authorizes operations via Azure RBAC roles assigned on the storage account. Assign the role that matches the operations StackOne will perform.

Grants read, write, and delete on blobs and containers — required for most StackOne actions.

  • Open the storage account in the Azure portal.
  • Select Access Control (IAM) in the left sidebar.
  • Click Add > Add role assignment.
  • Search for and select Storage Blob Data Contributor, then click Next.
  • Under Members, select User, group, or service principal and click Select members.
  • Search for the OAuth user who will connect StackOne and click Select.
  • Click Review + assign.

Required only if StackOne will use blob tag actions (Get Blob Tags, Set Blob Tags, Find Blobs By Tags). This role is a superset of Storage Blob Data Contributor.

  • Repeat the steps above and select Storage Blob Data Owner instead.

Create a client secret

Generate a secret that StackOne will use to authenticate the app registration against Microsoft Entra.

Navigate to Certificates & secrets under Manage.

  • Click New client secret.
  • Description: `StackOne Integration`
  • Select an expiration period.
  • Click Add.
  • Copy the secret Value immediately and store it securely for use later — it is only displayed once.
## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Azure Blob Storage: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  • Click + Connector Profile
  • Search for and select Azure Blob Storage
  • Select Type as OAuth 2.0 (Entra ID)
  • Fill out the fields using details retrieved from your provider:
    • Tenant ID
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
 Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Azure Blob Storage.