Files & storage
Set up Azure Blob Storage
Connect an Azure Blob Storage container — or a prefix within one — to make its files searchable: every blob becomes a document, and because each blob's ETag comes with the listing, later syncs re-read only blobs that actually changed. Only List Blobs and Get Blob are ever issued. Read-only.
The account key or SAS token
- Account key — Storage account → Security + networking → Access keys → key1 → Key; press Show and copy the whole value (it ends with ==). It opens the whole account, so prefer a SAS token to hand out less. Write-only here, never shown again after saving.
- SAS token — open the container → Shared access tokens (or the account's Shared access signature page), tick just Read and List, set an expiry you can live with, generate, and copy the token (the part starting sv=…, with or without the leading ?), issued for container and object resources both. Nothing is ever written with either credential.
- Documents → Azure Blob Storage: enter the Storage account (just the name — the part before .blob.core.windows.net) and the Container, then paste the Account key or the SAS token.
- Optionally set a Prefix under Advanced to sync a folder-like slice, and Exclude patterns for what to leave out (one pattern per line, * and ? wildcards). Add the source again for another container.
- Choose access groups, Test, then Sync.
What comes in
- Every blob under the container (or prefix) becomes one document, named from the tail of its blob name; placeholder names ending in / are skipped.
- Blobs in the Archive access tier are skipped, not errored on — Azure needs an hours-long rehydration first — and the sync summary counts them.
| Prefix | Optional — sync only blobs whose names start with this (e.g. policies/); blob names carry their whole path, so this is the folder-like scope. Blank = the whole container. |
|---|---|
| Endpoint suffix | Only for sovereign clouds (Azure China, US Government, Germany) — their own suffix in place of core.windows.net. Blank = global Azure. |
Access
Access is allow-only: the groups chosen on the source cover everything the container brings in — Blob Storage exposes no per-blob readers to mirror.
Test names the account, container and prefix it reached and whether blobs are visible. It fails with a specific reason: a refused key or token asks you to re-copy it whole (if the key is right, this server's clock may be off); a SAS token lacking Read + List, or not issued for container and object resources, is named as such; a wrong account or container name comes back as not found; an expired SAS token asks for a fresh one — the source stops syncing when the expiry passes, and a new token pasted here resumes it. Containers stop at 20,000 blobs per sync and say so — narrow the prefix to reach the rest; what already synced is kept rather than read as deleted.
Last updated 20 Sep 2026