C3 AI Documentation Home

Azure Blob Connector

The C3 Agentic AI Platform has a built-in connector for Azure Blob. To connect to a new Azure Blob storage account container, complete these steps:

  1. If you do not have a storage account and container in Azure, create them with the storage account access policies that the application needs.
  2. If you do not have a mount path for the Azure Blob storage account container, create one in the C3 Agentic AI Platform.
  3. Set the required credentials to access the contents of the storage account.
  4. Validate the connection.

To connect to Azure Data Lake Storage (ADLS) with an Azure application identity instead of an account key, see Configure service principal authentication for ADLS.

Create an Azure Blob storage account

Before you connect to an Azure Blob storage account, create a storage account and container in Azure. For more information on creating a storage account, see Create a storage account in the Microsoft Azure documentation. For more information on creating a container, see Create a container in the Microsoft Azure documentation.

To authorize the connection from the C3 Agentic AI Platform, you need an account access key or a shared access signature (SAS) token. For more information on access keys, see Manage storage account access keys in the Microsoft Azure documentation.

Minimum permissions needed for read-only access

Grant READ and LIST permissions on the SAS token or access key. With these permissions, the C3 Agentic AI Platform can read files and list the contents of the storage.

For more information on how to grant permissions in Azure, see the Azure Identity and Access Management (IAM) documentation.

Platform configurations

After you create the container and configure the appropriate access control policies on Azure, apply the following configurations on the C3 Agentic AI Platform side. Run the code in this section in the C3 AI Console.

Enable the file system

Run the following code to enable the Azure remote file system:

JavaScript
FileSystem.azure().enable();

For more information on enabling remote file systems on the C3 Agentic AI Platform, see Work With File Systems.

Create the file system mount

Use the following code to add a new file system mount path for Azure:

JavaScript
var mountName = "<mount_name>";
var containerName = "<azure_container_name>";

FileSystem.azure().setMount(mountName, "azure://" + containerName, ConfigOverride.APP);

Set credentials for the Azure Blob storage account container

The credential steps on this page need the C3.ClusterAdmin role.

To set the credentials that access the contents of the Azure Blob storage account container, you can use an account access key:

JavaScript
var subscriptionId = "<your_subscription_id>";
var accountName = "<your_storage_account_name>";
var containerName = "<your_container_name>";
var accessKey = "<your_access_key>";
var region = "<your_storage_account_region>";

var storageCredentials = AzureStorageCredentials.make({
  accountName: accountName,
  accessKey: accessKey,
});
var credentials = AzureCredentials.make({
  accountId: subscriptionId,
  region: region,
  storageCredentials: storageCredentials,
});
AzureBlobContainer.setCredentialsForResourceName(
  containerName,
  credentials,
  ConfigOverride.APP
);

You can also use a SAS token:

JavaScript
var subscriptionId = "<your_subscription_id>";
var accountName = "<your_storage_account_name>";
var containerName = "<your_container_name>";
var sasToken = "<your_sas_token>";
var region = "<your_storage_account_region>";

var storageCredentials = AzureStorageCredentials.make({
  accountName: accountName,
  sasToken: sasToken,
});
var credentials = AzureCredentials.make({
  accountId: subscriptionId,
  region: region,
  storageCredentials: storageCredentials,
});
AzureBlobContainer.setCredentialsForResourceName(
  containerName,
  credentials,
  ConfigOverride.APP
);

Finally, you can copy the credential that authorizes another Azure Blob storage account container. This option requires that the C3 Agentic AI Platform already connects to an existing Azure Blob container in the same storage account.

This option works only when you secure requests with the account access key:

JavaScript
var otherContainerName = "<name_of_the_existing_container>";
var containerName = "<your_container_name>";

var credentials = AzureCredentials.make(
  AzureBlobContainer.forResourceName(otherContainerName).credentials
);
AzureBlobContainer.setCredentialsForResourceName(
  containerName,
  credentials,
  ConfigOverride.APP
);

To minimize security risks, use a least-privilege approach when you set up IAM roles and credentials, especially in production environments.

Validate the connection

After you apply the required configurations, list the files in the Azure Blob storage account container to validate the connection:

JavaScript
var mountName = "<mount_name>";

FileSystem.azure().listFiles(FileSystem.azure().urlFromMount(mountName));

The request succeeds when the configuration is correct, even if the container has no files.

Clear credentials

To clear the credentials for an Azure Blob storage account container and delete its mount path, run the following code:

JavaScript
var containerName = "<your_container_name>";
var mountName = "<mount_name>";

var container = AzureBlobContainer.forResourceName(containerName);
container.clearConfigValue("credentials", ConfigOverride.APP);
container.clearSecretValue("credentials", ConfigOverride.APP);
FileSystem.azure().removeMount(mountName, ConfigOverride.APP);

Configure service principal authentication for ADLS

You can configure Azure Data Lake Storage (ADLS) with Azure Active Directory service principal (SP) authentication. With this method, the C3 Agentic AI Platform authenticates with an Azure application identity instead of a shared storage account key.

Use service principal authentication in enterprise environments. Service principal authentication supports Azure role-based access control (RBAC), gives granular permission control, and avoids distributing long-lived storage account keys.

Before you begin

Make sure you have the following:

  • An existing ADLS Gen2 storage account
  • A container created within the storage account
  • Permissions to create Azure AD app registrations
  • RBAC permissions to assign roles on the storage account

Step 1: Create a service principal in Azure

  1. In the Azure portal, go to Azure Active Directory > App registrations.
  2. Select New registration and create a new application.
  3. Open the Overview page of the new application.
  4. Record the following values:
    • Application (client) ID
    • Directory (tenant) ID

You need these values to configure credentials in the C3 Agentic AI Platform.

Step 2: Create a client secret

  1. In the app registration, go to Certificates & secrets.
  2. Select Client secrets.
  3. Select New client secret to generate a new secret.
  4. Copy the secret Value immediately.

The client secret value is visible only once. Store the client secret value securely before you leave the page.

Step 3: Grant the service principal access to ADLS

Assign an Azure RBAC role to the service principal on the ADLS Gen2 storage account or container.

For most Data Fusion ingestion scenarios, the recommended baseline role is:

  • Storage Blob Data Contributor: gives read and write access to containers and blobs. This role typically covers ingestion, file listing, and folder creation.

If your use case needs stricter or broader access, see the Azure RBAC documentation to select the appropriate permission level.

Assign the role at the correct scope, either the storage account or the container. With the wrong scope, the service principal may not reach the required file paths.

Step 4: Configure the mount in the C3 Agentic AI Platform

Define the ADLS mount path:

JavaScript
FileSystem.azure().setMount(
    "adlsbucketdz",
    "azure://adlsbucketdz/",
    ConfigOverride.APP
);

Where:

  • "adlsbucketdz": the logical name of the mount
  • "azure://adlsbucketdz/": the URL of the ADLS container, in the form azure://<container_name>/

Step 5: Configure Azure storage credentials

Create the storage credential reference:

JavaScript
creds = AzureStorageCredentials.make()
    .withAccountName("adlsbucketdz");

accountName must match the actual ADLS storage account name.

Step 6: Configure AzureCredentials with the service principal

Create credentials from the Azure AD service principal values:

JavaScript
credentials = AzureCredentials.make()
    .withActiveDirectoryId("<DirectoryTenantId>")
    .withAccessKey("<ApplicationClientId>")
    .withSecretKey("<ClientSecretValue>")
    .withStorageCredentials(creds);

Each credential field takes the following Azure value:

Credential fieldPlaceholderAzure value
accountName(set in Step 5)ADLS storage account name
activeDirectoryId<DirectoryTenantId>Azure AD directory (tenant) ID
accessKey<ApplicationClientId>Azure AD application (client) ID
secretKey<ClientSecretValue>The client secret value from Step 2

In this configuration, accessKey is the Azure application (client) ID, not a storage account access key.

Step 7: Attach credentials to the FileSourceSystem

Create a FileSourceSystem for the ADLS container, then bind the credentials from Step 6 to it. The rootUrlOverride field tells the platform which container the source system reads, in the same form as the mount URL from Step 4:

JavaScript
var fss = FileSourceSystem.make({
    name: "adlsbucketdz",
    rootUrlOverride: "azure://adlsbucketdz/"
}).upsert();

fss.setCredentials(credentials);

Step 8: Validate the configuration

Confirm that the service principal can access ADLS by listing a file in the container, for example test.json:

JavaScript
FileSystem.azure().listFiles("azure://adlsbucketdz/test.json");

If the listing succeeds, service principal authentication is configured correctly and Data Fusion can access the ADLS path.

How service principal authentication works

With service principal authentication:

  • Azure Active Directory (AAD) performs authentication.
  • Azure RBAC roles assigned on the storage account or container control authorization.
  • You need no storage account access keys.
  • The credentials apply only to the configured FileSourceSystem, which keeps access controlled and limited.

Security considerations

  • The platform stores the client secret as a secret configuration value of the application. If your deployment uses an external vault, secret values are kept there. Your C3 AI administrator can tell you which applies.
  • When you regenerate or rotate the client secret in Azure, set the new value in the credentials again.
  • Do not embed secrets directly in application code or configuration files in production environments.
  • Rotate client secrets periodically according to your organization's security policies.

See also

Was this page helpful?