Azure Blob Storage

This guide covers setting up an Azure Blob Storage connector in Slim.io using a Service Principal with OAuth2 client credentials.

Prerequisites

• An Azure subscription with Storage Accounts containing blobs you want to scan
• Azure Active Directory permissions to create app registrations
• Access to the Azure Portal or Azure CLI

Service Principal Setup

Step 1: Create an App Registration

1. In the Azure Portal, navigate to Azure Active Directory > App registrations.
2. Click New registration.
3. Name it slim-io-scanner (or your preferred name).
4. Set Supported account types to “Accounts in this organizational directory only.”
5. Click Register.

Step 2: Create a Client Secret

1. In the app registration, go to Certificates & secrets.
2. Click New client secret.
3. Set a description (e.g., “Slim.io Scanner”) and expiration period.
4. Click Add and immediately copy the secret value — it will not be shown again.

Step 3: Grant Storage Access

1. Navigate to the target Storage Account in the Azure Portal.
2. Go to Access control (IAM) > Role assignments.
3. Click Add > Add role assignment.
4. Select the Storage Blob Data Reader role.
5. Assign it to the slim-io-scanner app registration.
6. Click Save.

Repeat for each storage account you want to scan, or assign the role at the resource group or subscription level for broader access.

Step 4: Note the Required Values

Collect these values from the Azure Portal:

Connector Configuration in Slim.io

1. Navigate to Connectors > Add Connector in the Customer Dashboard.
2. Select Microsoft Azure.
3. Enter the Tenant ID, Client ID, and Client Secret.
4. Enter the Storage Account Name.
5. Optionally, configure container filters and prefix scope.
6. Click Test Connection.

If the test succeeds, the connector status changes to Active.

Required RBAC Roles

Multi-Storage Account Setup

For organizations with multiple storage accounts, you have two options:

1. One connector per storage account — Create a separate connector for each storage account with its own Service Principal
2. Shared Service Principal — Use a single Service Principal with Storage Blob Data Reader assigned at the subscription or resource group level, then create one connector per storage account referencing the same credentials

Option 2 reduces credential management overhead but grants broader access.

Troubleshooting

”Authorization Failed” on Test Connection

• Verify the Tenant ID and Client ID are correct
• Confirm the client secret has not expired
• Check that Storage Blob Data Reader is assigned on the correct storage account (not just the Reader role)

“Storage Account Not Found”

• Verify the storage account name is spelled correctly (case-sensitive)
• Ensure the storage account is in the same Azure AD tenant as the Service Principal

Client Secret Rotation

When rotating client secrets:

1. Create a new secret in the app registration
2. Update the connector in Slim.io with the new secret value
3. Test the connection to verify
4. Delete the old secret from Azure AD

Next Steps

• Run Your First Scan — Trigger a scan on this connector
• Event-Driven Scanning — Set up automatic scans via Azure Event Grid