> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Azure Blob Storage with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Azure Blob Storage account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Azure Blob Storage actions.

> [!WARNING]
>
> You need at least the Application Developer role in Microsoft Entra ID to register an application. Assigning the Azure role on the storage account requires Owner or User Access Administrator on that account.

## Register an application in Microsoft Entra ID

The application is the identity that accesses your storage account. The client credentials flow has no sign-in step, so no redirect URI is needed.

**1. Register the app**

Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) and open **Entra ID** > **App registrations**.

<ul>
  <li>If you manage more than one tenant, confirm you are in the correct directory using the **Settings** (gear) icon.</li>
  <li>Click **New registration**.</li>
  <li>**Name**: `StackOne Azure Blob Storage`</li>
  <li>**Supported account types**: **Single tenant only**</li>
  <li>**Redirect URI (optional)**: leave empty</li>
  <li>Click **Register**.</li>
</ul>

![The Register an application form with the Name, Supported account types and Register button highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-register-app.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=8839d00a2663f724ff18e5bf647ac8db)

**2. Copy the Application (client) ID and Directory (tenant) ID**

After registration the app's **Overview** page opens. In the **Essentials** panel, copy the **Application (client) ID** and the **Directory (tenant) ID** across.

<ul>
  <li>The **Application (client) ID** is your **Client ID**, and the **Directory (tenant) ID** is your **Tenant ID**.</li>
  <li>Format: `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`</li>
  <li>No API permissions or admin consent are needed on the app registration. Access to blobs is granted by the Azure role you assign on the storage account.</li>
</ul>

![The app Overview page with the Application (client) ID and Directory (tenant) ID highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-overview-ids.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=9499af967c125ffe7f367ba81c6cc30a)

## Create a client secret

A client secret is the password the application uses to prove its identity.

**1. Generate the secret**

In the app's left menu, open **Certificates & secrets**, stay on the **Client secrets** tab, and click **New client secret**.

<ul>
  <li>**Description**: `StackOne Integration`</li>
  <li>**Expires**: **Recommended: 180 days (6 months)**</li>
  <li>Click **Add**.</li>
</ul>

![The Add a client secret panel with the Description field and Add button highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-new-secret.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=91f01d7837e77dd12dbea13eff602d9a)

**2. Copy the secret value**

In the **Client secrets** table, click the **Copy to clipboard** icon beside the new secret's **Value** and copy it across. It is your **Client Secret**.

<ul>
  <li>The **Value** is only displayed once and cannot be retrieved after you leave this page, so copy it now. Do not copy the **Secret ID**, which is a different value.</li>
  <li>Create a new secret before this one expires.</li>
</ul>

![The Client secrets table with the Copy to clipboard icon beside the secret Value highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-secret-value.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=1dfae16b267d330b3dd459a96bf12ee3)

## Assign an Azure role to the application

Azure Storage authorizes each request through an Azure role assigned on the storage account. Assign the role to the application you registered.

**1. Select the Storage Blob Data Contributor role**

Sign in to the [Azure portal](https://portal.azure.com), search for **Storage accounts** in the top search bar, select the storage account you want to connect, and in its left sidebar select **Access Control (IAM)**.

<ul>
  <li>Click **Add**.</li>
  <li>Select **Add role assignment**.</li>
  <li>On the **Role** tab, under **Job function roles**, search for **Storage Blob Data Contributor**.</li>
  <li>Select the **Storage Blob Data Contributor** row. It grants read, write and delete access to blobs and containers.</li>
  <li>If you need to read or set blob tags, find blobs by tags, or read or set container access policies, select **Storage Blob Data Owner** instead. It is a superset of Storage Blob Data Contributor.</li>
  <li>Reading or setting the blob service properties needs a second role assignment to the same application, since no Storage Blob Data role includes it. Repeat these steps with **Reader** for read-only access, or **Storage Account Contributor** to read and set them.</li>
  <li>Click **Next**.</li>
</ul>

![The Add role assignment Role tab with Storage Blob Data Contributor selected and the Next button highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-role-tab.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=7afce5952cc7c6f132118c10359b25c7)

**2. Add the application as a member**

On the **Members** tab, keep **Assign access to** set to **User, group, or service principal**.

<ul>
  <li>Click **Select members**.</li>
  <li>In the search box, enter `StackOne Azure Blob Storage`. Applications only appear in the results when you search for them by name.</li>
  <li>Select the application in the results.</li>
  <li>Click **Select**.</li>
  <li>Click **Review + assign**.</li>
</ul>

![The Select members panel with the application found by name and the Select button highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-select-members.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=91519bba78b02a49904cbb7b1701647b)

**3. Finish the role assignment**

On the **Review + assign** tab, check the **Role**, **Scope** and **Members**, then click **Review + assign**.

<ul>
  <li>A new role assignment can take a few minutes to take effect.</li>
</ul>

![The Review + assign tab summarizing the role, scope and member with the Review + assign button highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-review-assign.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=fa3d6c2e8ecffa3ae1df9223d322d3b3)

## Find your storage account name

Your storage account name identifies the Azure Storage resource to connect.

**1. Copy the storage account name**

In the [Azure portal](https://portal.azure.com), search for **Storage accounts** in the top search bar, select the storage account you assigned the role on, and on its **Overview** page copy the name shown as the page heading across. It is your **Storage Account Name**.

<ul>
  <li>Format: `mystorageaccount` (lowercase; 3–24 characters; letters and digits only)</li>
  <li>Example: if your blob endpoint is `https://acmeprod.blob.core.windows.net`, your **Storage Account Name** is `acmeprod`</li>
</ul>

![The storage account Overview page with the account name heading highlighted](https://mintcdn.com/stackone-60/VFAlkFCgXh-tN8T7/connectors/azureblobstorage/images/oauth2_client_credentials-config-account-name.png?fit=max\&auto=format\&n=VFAlkFCgXh-tN8T7\&q=85\&s=14ac952bc39bbb1302998ba302c93213)

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Next Steps

> [card] [Webhooks setup](https://docs.stackone.com/connectors/azureblobstorage/guides/webhook-setup.md)
>
> Configure receiving Events for Azure Blob Storage into StackOne.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.