There are three parts to integrating Azure with Encord:

  1. Creating the integration with the Encord platform.

  2. Authenticating your storage account for integration on the Azure platform.

Ensure that all objects in your Azure Blob have the Hot Tier access tier.
  1. Setting up Cross-Origin Resource Sharing (CORS) on Azure.

​
1. Start Setting up the Integration

  1. In Encord, navigate to the Integrations section and click the Add integration button.

  1. Click on Azure.

  2. Give your integration a meaningful name.

​
2. Register the Azure storage account with Encord

  1. Paste the name of your Azure storage account into Step 2 of the integration.

​
3. Select authentication type

Select your preferred method of authentication in Step 3 the Azure integration window.

​
4. Authenticate Azure

You can authenticate Azure in two different ways:

  1. Generating an account-level shared access signature (SAS).

  2. Using a service principal.

Using a service principal to authenticate requires admin privileges for the Azure account.

​
Method 1: Generating an Account-Level SAS

  1. In Azure, navigate to Storage Accounts under Azure services and select the storage account you wish to integrate.
  1. Next, click on Shared access signature in the Security + networking section.
  1. You must check the Container and Object checkboxes under the Allowed resource types heading. Ensure you add the necessary permissions:
  • Read (required)
  • List (required)
  • Write (recommended)
  • Add (recommended)
  • Create (recommended)
recommended permissions are necessary to use some of our more advanced features such as re-encoding data, and image sequences.
  1. Click Generate SAS and connection string when you are ready to generate your account-level SAS token.
Your SAS token has a start and end date that can be adjusted, and is valid for the specified time period. Expired tokens must be updated.
To avoid having to update the token frequently, set the expiration date to be more than one year.
  1. Paste the SAS token into Step 4 of the Azure integration window, in Encord.

​
Method 2: Using a Service Principal

Using a service principal to authenticate you require you to:

  1. Add the cord-integrator app to your Azure tenant.
  2. Find your Azure tenant ID.

​
Adding the cord-integrator app to Azure tenant

There are three different ways to add the cord-integrator app to Azure tenant:

  1. Using a browser.

  2. Using Azure powershell.

  3. By granting storage account and container permissions to cord-integrator.

You need to have admin privileges for your Azure account to authenticate via a service principal.

​
Adding the cord-integrator app in a browser

You can add the cord-integrator application in the Settings of the Encord app. If logged in to the Encord platform, you are redirected to the ‘Azure integration’ screen after the application was successfully added.

Adding the 'cord-integrator' application to Azure tenant

​
Adding the cord-integrator app via Azure Powershell

New-AzADServicePrincipal -ApplicationId ab859d51-5577-4d6d-9b87-544df597f38a

​
Granting storage account and container permissions to cord-integrator

The cord-integrator must be granted two types of permissions in order to function:

  • The Storage Blob Data Contributor role at the container level Adding the 'Storage Blob Data Contributor' role to the cord-integrator service principal
  • The Storage Blob Delegator role at the storage account level Adding the 'Storage Blob Delegator' role to the cord-integrator service principal at the storage account level

​
Find your Azure tenant ID

You can find the Azure Tenant ID in the Active Directory overview of your Azure project.

Paste the tenant ID into Step 4 of the Azure integrations window, after you have added the cord-integrator app, granted it storage account, and container permissions and located your Azure tenant.

​
5. Creating a CORS Configuration in Azure

A CORS configuration must be applied to the Azure storage account you want to integrate with Encord. This enables Encord to request resources from the specified service account using a browser.

  1. Navigate to the Resource Sharing (CORS) section under Settings of your storage account.
  1. Input the following values in the Blob service tab of Resource Sharing (CORS) page:
Allowed originsAllowed methodsAllowed headersExposed headersMax age
<https://app.encord.com\>GET, POST, OPTIONS, PUT**3600
<https://api.encord.com\>GET, POST, OPTIONS, PUT**3600
<https://app.us.encord.com\>GET, POST, OPTIONS, PUT**3600
<https://api.us.encord.com\>GET, POST, OPTIONS, PUT**3600

In the example above, preflight requests are valid for 1 hour. Use the ‘Max Age’ variable to adjust the number of seconds the browser is allowed to make requests before it must repeat the preflight request.

  1. Click Save to save the CORS configuration.

  2. Click Create to finish setting up the integration, in Encord.

​
6. Test Your Integration

Click the Run a test button on the integration, to test that the integration works.

Paste the URL of any object in your Azure storage and click Check Encord can access this URL. If the test is successful a green tick appears next to Encord infrastructure and This machine.

​
Updating Expired Account-Level SAS Tokens

This section is only applicable if you used an account-level shared access token to authenticate.

Shared access tokens expire and have to be updated in order to continue providing Encord with access to your Azure storage.

To update the account-level SAS token:

  1. Click the three dots icon on your Azure integration.

  2. Click Update SAS token.

A field for your new SAS token appears.

  1. In Azure, navigate to Storage Accounts under Azure services and select the storage account you wish to update the token for.
  1. Click on Shared access signature in the Security + networking section.
  1. You must check the Container and Object checkboxes under the Allowed resource types heading. Ensure you add the necessary permissions:
  • Read (required)
  • List (required)
  • Write (recommended)
  • Add (recommended)
  • Create (recommended)
recommended permissions are necessary to use some of our more advanced features such as re-encoding data, and image sequences.
  1. Click Generate SAS and connection string to generate a new account-level SAS token.
Your SAS tokens have a start and end date that can be adjusted, and are only be valid for the specified time period. Expired tokens must be updated.
To avoid having to update the token frequently, set the expiration date to be more than one year.
  1. Paste the new SAS token, in Encord.

​
Registering Azure Data

Navigate to the Register cloud data page for guidance on how to register data stored in Azure.