Azure Blob Storage

Polytomic supports the following authentication methods with Azure Blob Storage:

• Access key (a storage account access key or a SAS token)
• Client credentials (a Microsoft Entra ID service principal)
• OAuth

Each method requires the storage Account name and Container name from the Azure portal. Have them ready before you connect Polytomic.

Polytomic reads CSV, JSON (including JSON Lines), and Parquet files. Files may also be compressed with .gz, .bz2, or .zst. The Files are time-based snapshots and Multi-directory multi-table options work the same way as for S3. See Syncing from S3 for details.

Connecting with an access key

1. In Polytomic, go to Connections → Add connection → Azure Blob Storage.
2. Select Access Key in the Authentication method dropdown.
3. In the Azure portal, open your storage account and obtain either:

   • An access key: under Security + networking, select Access keys, and copy key1 or key2. An access key grants full access to the storage account.

   • A SAS token: under Security + networking, select Shared access signature and copy the token. Alternatively, generate a SAS for the container from the container's Shared access tokens page. To read from the container, the SAS must allow Read and List. To write, it must also allow Write, Create, Add, and Delete. For an account SAS, allow the Blob service and the Container and Object resource types.

   🚧

   SAS expiry

   Polytomic can't connect after the SAS expires. Choose an expiry that fits how long you plan to use the connection.

4. Enter your credentials in Polytomic's Account name, Access key (paste either the access key or the SAS token), and Container name fields.

5. Click Save.

Connecting with client credentials

To connect using a Microsoft Entra ID application (service principal):

1. In the Azure portal, go to Microsoft Entra ID → App registrations → New registration and register an application. Note its Application (client) ID and Directory (tenant) ID.

2. In the application's Certificates & secrets page, create a client secret and copy its Value.

3. Grant the application access to your data. On the storage account (or the container), go to Access control (IAM) → Add role assignment, and assign the application one of these roles:

   • Storage Blob Data Reader if Polytomic only reads.
   • Storage Blob Data Contributor if Polytomic also writes.

   Management roles such as Owner or Contributor don't grant access to blob data.

4. In Polytomic, select Client credentials as the Authentication method and enter the Tenant ID, Client ID, Client secret, Account name, and Container name:

Connecting with OAuth

When you connect with OAuth, Polytomic accesses the storage account as the Azure user who authorizes the connection. That user must have the Storage Blob Data Reader role (to read) or Storage Blob Data Contributor role (to write) on the storage account or container. Management roles such as Owner or Contributor alone aren't sufficient.

To connect with OAuth:

1. Select the OAuth option as your Authentication method.
2. Click the Connect to Azure Blob Storage button to authenticate with Azure using OAuth:

3. Enter your Container name and Account name.
4. Click Save.