There are three parts to integrating Azure with Encord:
Setting up Cross-Origin Resource Sharing (CORS) on Azure.
On Encord, navigate to your Settings from the drop-down on the top right.
Open the 'Integrations' tab and click the Add integration button.
Navigate to the Azure tab and type the name of the storage account you registered in step 1 of the integration into the first dropdown in the Azure integrations window, as shown below.
Select your preferred method of authentication in the second dropdown of the Azure integrations window.
Optionally check the box to enable Strict client-only access, server-side media features will not be available if you would like Encord to sign URLs, but refrain from downloading any media files onto Encord servers. Read more about this feature here.
You can authenticate Azure in two different ways:
Using a service principal to authenticate requires admin privileges for the Azure account.
In Azure, navigate to Storage Accounts under 'Azure services' and select the storage account you wish to integrate.
Next, click on Shared access signature in the 'Security + networking' section.
You'll need to check the 'Container' and 'Object' checkboxes under the 'Allowed resource types' heading. Please note the following permissions:
- Read (required)
- List (required)
- Write (recommended)
- Add (recommended)
- Create (recommended)
'Recommended' permissions are necessary to use some of our more advanced features such as 're-encoding' data, and 'optimized image groups'. Click Generate SAS and connection string when you are ready to generate your account-level SAS token.
Your SAS token will have a start and end date that can be adjusted, and it will only be valid for the specified time period. Expired tokens will have to be updated.
Now that you have generated your account-level SAS token, you can post it into the third dropdown of the Azure integrations window on Encod, as shown below.
Using a service principal to authenticate you require you to:
There are three different ways to add the cord-integrator app to Azure tenant:
Via a browser.
Via Azure powershell.
By granting storage account and container permissions to cord-integrator.
You need to have admin privileges for your Azure account to authenticate via a service principal.
You can add the cord-integrator application by following this link. If logged in to the Encord platform, you will be redirected to the 'Azure integration' screen after the application was successfully added.
New-AzADServicePrincipal -ApplicationId ab859d51-5577-4d6d-9b87-544df597f38a
The cord-integrator must be granted two types of permissions in order to function:
- The Storage Blob Data Contributor role at the container level
- The Storage Blob Delegator role at the storage account level
You can find the Azure Tenant ID in the Active Directory overview of your Azure project.
After you have added the cord-integrator app, granted it storage account and container permissions, as well as located your Azure tenant ID - paste the tenant ID into the third step of the Azure integations window, as shown below.
A CORS configuration needs to be applied to the Azure storage account you wish to integrate with Encord. This will enable your users' browsers to request resources from the specified service account.
Navigate to the 'Resource Sharing (CORS) section under Settings of your storage account.
Input the following values in the 'Blob service' tab of Resource Sharing (CORS) page:
|Allowed origins||Allowed methods||Allowed headers||Exposed headers||Max age|
|https://app.encord.com||GET, POST, OPTIONS, PUT||*||*||3600|
In the example above, preflight requests are valid for 1 hour. Use the 'Max Age' variable to adjust the number of seconds the browser is allowed to make requests before it must repeat the preflight request.
Click Save to save the CORS configuration.
To test that Encord can sync with your Azure storage, click the icon where you integration is listed.
Enter the URL of an object you would like to test the connection with and click Check Encord can access this URI. If the test is successful a green tick will appear next to Encord infrastructure as well as This machine, as seen in the screenshot for a GCP test below (the process for Azure is identical).
This section is only applicable if you used an account-level shared access token to authenticate.
Shared access tokens expire and have to be updated in order to continue providing Encord with access to your Azure storage. To do so, simply click the icon on your Azure integration, as seen below.
Generate a new account-level SAS token and paste it into the pop-up that appears.
Please navigate to the private cloud integration section for guidance on how to create a dataset with data stored in Azure.
Updated 26 days ago