> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/clouds/azure/blob-storage.md).

# Blob Storage

## Requirements

In order to integrate Teleskope with Azure Blob Storage, you must make sure the following prerequisites are met:

* Within Azure: You must have created an Entra App as described previously
* Within Teleskope: A Teleskope admin account to complete the setup process.

## Integration

Teleskope discovers every subscription in the tenant that the app can read. There is no per-subscription enrollment: grant the roles below on each subscription you want crawled.

For each subscription:

{% stepper %}
{% step %}
**Grant the Teleskope app read access to Azure Blob Storage**

Grant the Teleskope app the following role:

* Storage Blob Data Reader

Teleskope also lists subscriptions, storage accounts, blob inventory policies, and container role assignments. Grant the Teleskope app either the **Reader** role, or a custom role with the following permissions:

* Microsoft.Storage/storageAccounts/read
* Microsoft.Storage/storageAccounts/\*/read
* Microsoft.Authorization/roleAssignments/read
  {% endstep %}

{% step %}
**Grant the Teleskope app Microsoft Graph read access**

Teleskope resolves the users and groups in container role assignments and file ACLs through Microsoft Graph. Add the following *Application Permissions* to the app registration and grant admin consent:

* User.Read.All
* GroupMember.Read.All

Without them, Teleskope omits those grants from the access data.
{% endstep %}

{% step %}
**Grant the Teleskope app write access to Azure Blob Storage (optional)**

Grant the Teleskope app the following role:

* Storage Blob Data Contributor

To revoke access with Policy Maker, also grant a role that can delete role assignments at container scope, such as **Role Based Access Control Administrator**. On accounts with hierarchical namespace enabled, revoking file ACL entries also requires **Storage Blob Data Owner**.
{% endstep %}
{% endstepper %}

### Network access

If a storage account restricts public network access, allow access from the Teleskope deployment. When Teleskope runs in your Azure environment, allow the cluster's subnet or add a private endpoint reachable from it. Otherwise, allow the deployment's outbound IP addresses.

### Inventory Reports (optional)

Follow Azure's documentation to setup CSV inventory reports for your [containers](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory). This will allow us to crawl your containers with optimized speed, and minimize the cost incurred on the Azure side by limiting the amount of API calls we make.

If cost-appropriate, please toggle on **Enable access tracking** in the Blob inventory settings page. This allows you to view access history per-blob and use the field as a trigger in Policy Maker.