Authentication and Access Management Between CloudSoda and Azure Cloud Storage

Available authentication methods between CloudSoda and Azure are changing because of Microsoft's best practice of not using storage account key authentication due to security concerns. We recommend that CloudSoda customers use the following process to create an IAM user for the CloudSoda application in order to integrate securely with Azure.

Register an Application

1. Log into the Azure console. 
   
   
   
   
2. Navigate to App Registration by clicking Microsoft Entra ID > Add > App registration. 
   
   
   
   Alternatively, enter "app registration" in the search bar and select App registrations.
   
   
   The Register an application screen loads.
   
   
   
   
3. Enter an application name, select the single tenant account type (first option), and click Register. Do not enter redirect URI values.
   
   
4. Copy the Application (client) ID and Directory (tenant) ID for later use.
   
   

Add Authorization Credentials to the Application

CloudSoda supports two authorization credential methods - using certificates and client secrets. Both methods are detailed below.

Using a Client Secret (Option A)

1. In the Client credentials section, click Add a certificate or secret. 
   
   
   
2. Add the client secret to Microsoft Entra ID.
   1. Click Certificates & secrets > Client secrets.
   2. In the Client secrets section, click New Client Secret, enter a description, select an expiration duration, and click Add. 
      
      
3. Copy the Value and Secret ID for later use. 
   
   
   
   
4. Click Overview and verify that the Managed Application entry lists shows the application you created. 
   
   

Using a Public Certificate (Option B)

1. In the Client credentials section, click Add a certificate or secret. 
   
   
   
2. Create a public certificate. For details, see: 
   • Create a Self-Signed Public Certificate to Authenticate Your Application
   • Certificate Display and Signing
3. Add the certificate to Microsoft Entra ID.
   1. Click Certificates & secrets > Certificates.
   2. In the Upload certificate section, upload the certificate (public key), enter a description, and click Add. 
      
      
      
      
4. Copy the Certificate ID for future use. 
   
   
5. Click Overview and verify that the Managed Application entry lists shows the application you created. Once verified, go to the next procedure, Assign Permissions to the Application.
   
   

Assign Permissions to the Application

1. Return to the storage account screen.
2. Click Access Control (IAM) > Role Assignments > Add > Add Role Assignment.
   
   
   
   The Add role assignment screen displays.
   
   
3. Assign read-write permissions. 
   1. Search for and select Storage Blob Data Reader. 
      
      
   2. Search for and select Storage Blob Data Contributor.
      
      
      
      
4. Click Members > Select Members and search for the service principal name of the application.
   
   
   
   
5. Select the application name and click Add. 
   
   
6. In the Members section, verify the Object ID is listed.
   
   

Configure CloudSoda

1. Log into CloudSoda.
   
   
   
   
2. Click Agent > Accessor > Create a New Accessor.
   
   
3. Create and configure the Accessor.
   1. Enter an Accessor Name, Account, and Scope. 
   2. For the Accessor Type, select Azure. 
   3. For the Authorization Type, select Client Certificate Credential or Client Secret Credential, depending on the authorization credential method you used. 
      
      
4. Edit the Accessor for the authorization credentials. 
   1. If using a public certificate:
      1. Enter the Tenant ID, Client ID, Certificate ID and Certificate. Additionally, if using a .p12 file, enter the Password.
      2. Click Configure Accessor.
         
         
         
         
   2. If using a client secret:
      1. Enter the enter the Tenant ID, Client ID, Secret ID, and Secret. 
      2. Click Configure Accessor
         
         
         
         
5. Select the Accessor you just created.
   
   
   
   
6. Select the ellipsis (...) in the top right corner and click Enable. 
   
   
   
   The Accessor is now enabled.
   
   
7. Attach the Accessor to an Agent. 
   1. 1. Click Agents in the top right corner to return to the Agents list. 
      2. Select the Agent. A pop-up window displays.
      3. Click Attach Storage. 
         
         
         
      4. Select the previously-created Azure storage. 
      5. Select the Accessor or method you created.
      6. Click Attach. 
         

The Agent is now listed with the assigned storage. The Accessor's status is displayed on the Agent page. 

Reference Articles

These articles provide additional information about app registrations and workload identities: 

• Application and Service Principal Objects in Microsoft Entra ID
• Create a Self-Signed Public Certificate to Authenticate Your Application