Azure Blob Storage
Read and write blobs in Azure Storage, including Azure Government, Azure China and Azure Stack. Signs in with Microsoft Entra ID, a SAS, an account key or a pasted connection string.
Settings
What the connection form asks for. Every connection has a Staging side, which it needs, and an optional Production side with values of its own; both ask for the same settings.
| Account Name | |
| Container | |
| Endpoint (optional) | Set only for a non-public cloud or a private endpoint - Azure Government, Azure China, Azure Stack, or a local emulator. Blank uses https://<account>.blob.core.windows.net. |
| Sign in with | Leave the chosen method's credential blank to use the server's managed identity instead (recommended when Trinium runs on Azure VM / AKS / App Service). Choices: Account key; Connection string; Microsoft Entra ID; Shared access signature (SAS). |
| Account Key | Storage account > Access keys > Key. Many enterprise tenants disable shared-key access by policy; use Microsoft Entra ID there. Shown when Sign in with is Account key. Stored encrypted, and never shown again after you save it. |
| Connection string | The whole DefaultEndpointsProtocol=...;AccountName=...;AccountKey=...;... string from Access keys. It fills in the account name and the endpoint too, so a sovereign-cloud or Azurite string needs nothing else. Shown when Sign in with is Connection string. Stored encrypted, and never shown again after you save it. |
| Directory (tenant) ID | Entra ID > App registrations > your app > Overview. Shown when Sign in with is Microsoft Entra ID. |
| Application (client) ID | Shown when Sign in with is Microsoft Entra ID. |
| Client secret | The secret VALUE, not its ID. The app also needs a data-plane role on the storage account: Access control (IAM) > Add role assignment > Storage Blob Data Contributor. An app registration on its own can read nothing. Shown when Sign in with is Microsoft Entra ID. Stored encrypted, and never shown again after you save it. |
| SAS token | Paste the token (with or without the leading '?'). Generate it with the Blob service, the Container and Object resource types, and the Read, List, Write, Create, Add and Delete permissions. Every other option on that form is baked into the token. A SAS EXPIRES - the pipeline stops when it does. Shown when Sign in with is Shared access signature (SAS). Stored encrypted, and never shown again after you save it. |
Testing the connection
Test lists the container. A wrong account key or secret fails. A real credential that is not allowed to list still passes, because Azure signs you in before it checks permissions.
Good to know
- Four ways to sign in: an account key, a connection string, a Microsoft Entra ID app, or a shared access signature (SAS). The choice is explicit, so a leftover key never quietly wins over a new one.
- Many enterprise tenants turn off account-key access by policy; an Entra ID app or a SAS works there.
- Leaving the chosen method's credential blank uses the server's managed identity, on a shared connection an administrator manages only.
- The endpoint setting reaches Azure Government, Azure China, Azure Stack and private endpoints.
Nodes that use it
Write the pipeline's output to an Azure Storage container with a templated blob path (dates, run id) and a write mode.
Read a single blob or a whole prefix from an Azure Storage container. A Bookmark can read only the files no successful run has read.
Copy, move or delete the files an input, List Files or File from URL hands it through its Files anchor, before the data is processed or after the run succeeds or fails.
List the files in a folder as rows, with each one's path, name, size and modified time, without reading any of them.