Azure blob

There are three parts to integrating Azure with Encord:

1. Authenticating your storage account for integration on the Azure platform.

2. Integrating Azure with the Encord platform. Strict client-only access can also be added in this step if necessary.

3. Setting up Cross-Origin Resource Sharing (CORS) on Azure.

1. Creating the integration

On Encord, navigate to your Settings from the drop-down on the top right.

Open the 'Integrations' tab and click the Add integration button.

Navigate to the Azure tab and type the name of the storage account you registered in step 1 of the integration into the first dropdown in the Azure integrations window, as shown below.

Select your preferred method of authentication in the second dropdown of the Azure integrations window.

• Shared access signature.
• (Legacy) Azure service principal.

Optionally check the box to enable Strict client-only access, server-side media features will not be available if you would like Encord to sign URLs, but refrain from downloading any media files onto Encord servers. Read more about this feature here.

2. Authenticating Azure

You can authenticate Azure in two different ways:

1. Generating an account-level shared access signature (SAS).

2. Using a service principal.

ℹ️

Note

Using a service principal to authenticate requires admin privileges for the Azure account.

Method 1: Generating an account-level SAS

In Azure, navigate to Storage Accounts under 'Azure services' and select the storage account you wish to integrate.

Next, click on Shared access signature in the 'Security + networking' section.

You'll need to check the 'Container' and 'Object' checkboxes under the 'Allowed resource types' heading. Please note the following permissions:

• Read (required)
• List (required)
• Write (recommended)
• Add (recommended)
• Create (recommended)

'Recommended' permissions are necessary to use some of our more advanced features such as 're-encoding' data, and 'optimized image groups'. Click Generate SAS and connection string when you are ready to generate your account-level SAS token.

🚧

Caution

Your SAS token will have a start and end date that can be adjusted, and it will only be valid for the specified time period. Expired tokens will have to be updated.

Now that you have generated your account-level SAS token, you can post it into the third dropdown of the Azure integrations window on Encod, as shown below.

Method 2: Using a service principal

Using a service principal to authenticate you require you to:

1. Add the cord-integrator app to your Azure tenant.
2. Find your Azure tenant ID.

Adding the cord-integrator app to Azure tenant

There are three different ways to add the cord-integrator app to Azure tenant:

1. Via a browser.

2. Via Azure powershell.

3. By granting storage account and container permissions to cord-integrator.

ℹ️

Note

You need to have admin privileges for your Azure account to authenticate via a service principal.

Adding the cord-integrator app via a browser

You can add the cord-integrator application by following this link. If logged in to the Encord platform, you will be redirected to the 'Azure integration' screen after the application was successfully added.

Adding the cord-integrator app via Azure Powershell

New-AzADServicePrincipal -ApplicationId ab859d51-5577-4d6d-9b87-544df597f38a

Granting storage account and container permissions to cord-integrator

The cord-integrator must be granted two types of permissions in order to function:

• The Storage Blob Data Contributor role at the container level
  
• The Storage Blob Delegator role at the storage account level
  

Find your Azure tenant ID

You can find the Azure Tenant ID in the Active Directory overview of your Azure project.

After you have added the cord-integrator app, granted it storage account and container permissions, as well as located your Azure tenant ID - paste the tenant ID into the third step of the Azure integations window, as shown below.

3. Creating a CORS configuration in Azure

A CORS configuration needs to be applied to the Azure storage account you wish to integrate with Encord. This will enable your users' browsers to request resources from the specified service account.

Navigate to the 'Resource Sharing (CORS) section under Settings of your storage account.

Input the following values in the 'Blob service' tab of Resource Sharing (CORS) page:

In the example above, preflight requests are valid for 1 hour. Use the 'Max Age' variable to adjust the number of seconds the browser is allowed to make requests before it must repeat the preflight request.

Click Save to save the CORS configuration.

4. Testing your integration

To test that Encord can sync with your Azure storage, click the icon where you integration is listed.

Enter the URL of an object you would like to test the connection with and click Check Encord can access this URI. If the test is successful a green tick will appear next to Encord infrastructure as well as This machine, as seen in the screenshot for a GCP test below (the process for Azure is identical).

5. Updating expired account-level SAS tokens

ℹ️

Note

This section is only applicable if you used an account-level shared access token to authenticate.

Shared access tokens expire and have to be updated in order to continue providing Encord with access to your Azure storage. To do so, simply click the icon on your Azure integration, as seen below.

Generate a new account-level SAS token and paste it into the pop-up that appears.

6. Creating a dataset with Azure data

Please navigate to the private cloud integration section for guidance on how to create a dataset with data stored in Azure.