What it scans
Blobs in one container, optionally limited to a literal name prefix. This is Blob Storage, not Azure Files SMB, database scanning or subscription discovery.
What you need
An agent, the HTTPS account endpoint and container name. Choose a read-only SAS or workload identity. Account keys also work but grant broad account access. Hosted agents require approved public Azure Blob endpoints; use a customer-run agent for private networking.
Step 1: Grant access
For workload identity, enable the agent host's managed identity. In Azure portal → Storage accounts → your account → Containers → your container → Access control (IAM) → Add role assignment, select Storage Blob Data Reader, select the agent identity and save. Scope the assignment to this container. Ensure the identity is available inside the agent container. Myrikeep uses DefaultAzureCredential. Allow time for RBAC propagation. Hosted workload identity needs the operator's explicit opt-in.
For a SAS, open Storage accounts → your account → Containers → your container
→ Shared access tokens. Prefer a User delegation key if your admin can
issue one. Select only Read and List (sp=rl), container resource
(sr=c), and HTTPS only. No Add, Create, Write, Delete, Tags or ownership
permissions. A blob-only SAS cannot enumerate a container. Use an expiry just
long enough for the planned scans; for a pilot, one day is a useful starting
point. User delegation SAS validity cannot exceed seven days. Rotate before
expiry for recurring scans. Omit the start time where allowed, or backdate it
slightly to allow for clock differences. Copy the SAS token, not the full URL.
See SAS access options
and SAS permissions.
A container SAS grants access across that container; the console prefix does not restrict its authority. Use a dedicated container for a smaller boundary. For account-key access, Storage account → Security + networking → Access keys → Show supplies the account name and key. Store them only on the agent. Account keys cannot be made read-only; prefer SAS or identity when possible.
Step 2: Add the connection
In Connections → Add connection, choose Azure Blob container, paste the account's Blob service endpoint without a SAS query, enter the container and prefix, and select your agent. Choose Local credential catalog for either SAS or account key. Choose S3/Azure workload identity for a host identity and leave the credential name empty. Save the files below when using the catalog.
Connection settings table
| Console field | Example | Required or optional |
|---|---|---|
| Connection name | Finance blobs |
Required; unique in workspace |
| Type | Azure Blob container (azure) |
Required |
| Account URL | https://examplestore.blob.core.windows.net |
Required; HTTPS, no SAS/query/fragment |
| Container | reports |
Required |
| Prefix | finance/ |
Optional; blank scans whole container |
| Agent | Storage agent |
Required; same workspace |
| Credential mode | Local credential catalog or S3/Azure workload identity | Required |
| Credential name | AZURE_REPORTS |
Required for catalog; empty for workload identity |
| Exclude patterns (View/edit) | *.tmp |
Optional; one glob per line |
| Enabled (connection row) | Enabled | Disable to stop new scans |
Account name/key and SAS are secret-file fields, not console config fields. The catalog payload selects SAS versus account-key authentication automatically.
Secret file
For SAS, save /srv/myrikeep/secrets/AZURE_REPORTS with exactly:
{"sas_token": "<CONTAINER_SAS_TOKEN_WITH_READ_AND_LIST>"}
Or use the account-key shape, never both shapes in one file:
{"account_name": "examplestore", "account_key": "<STORAGE_ACCOUNT_KEY>"}
Merge this catalog entry:
{"version": 1, "credentials": {"AZURE_REPORTS": {"type": "azure", "source": {"kind": "file_json", "path": "/run/secrets/AZURE_REPORTS"}}}}
Follow Agent credentials for ownership, modes and the read-only mount. Workload identity requires no secret file or catalog entry.
Scope, exclusions and schedules
The prefix is a literal, case-sensitive blob name prefix. Exclude globs such as
*.tmp, finance/cache/* or */scratch/* match full blob names and basenames
before content reads. See Getting started
for schedule cadence. Keep SAS expiry beyond scheduled scan completion.
"Who can see it" support
Sharing checks are not available for this source yet. Phase 1 does not inspect anonymous container access, SAS distribution or Azure role assignments. Last-modified dates support age review. See Who can see it.
Troubleshooting
| State or error | What to do |
|---|---|
unknown |
Check current-revision heartbeat, assignment and agent online status. |
missing / credential_missing |
Check alias/type and mount, or make workload identity available inside the agent. |
Invalid / credential_config_invalid |
Use exactly one JSON shape; check file owner/mode and nonempty strings. |
present |
Credential was resolved; a scan must still verify container access. |
source_error / cannot open Azure Blob client for container |
Check account URL, container existence, TLS and container-property read permission in local agent diagnostics. |
| AuthorizationPermissionMismatch / access denied | SAS needs rl on this container, or identity needs Storage Blob Data Reader at this scope. Allow RBAC propagation time. |
| AuthenticationFailed | Renew expired/not-yet-valid SAS or rotated account key; check UTC clock. |
| Hosted source or endpoint prohibited | Use a customer-run agent for custom/private endpoints. |
| Paused / Migration paused / Disabled | Resume agent, assign and save migrated connection, or enable it. |
signin_required |
Only personal drives use interactive sign-in; Azure uses the chosen catalog or host identity. |
Limits
No writes, container discovery, snapshots/version history or archive rehydration. Directory markers are skipped. Above one million listed blobs the connector fails and asks for a narrower prefix; configured agent limits may be lower. Sampling and parsing are bounded. Common text, PDF text and modern Office have parsers; other formats use strings-only checks. Text in images and scanned PDFs needs OCR, an optional premium feature a workspace owner enables; it runs inside your agent with the OCR agent image. Inspect Coverage for skips.