# Azure Blob Storage

URL: /collect/sources/azure-blob

Read logs from a blob container in your Azure subscription, including Azure Government, through a managed identity that holds read access to the container and nothing more.



Connect a container once, and Foxborne reads new blobs as they land. It reads through a managed identity that you grant read access, and it never writes to the container.

## Before you start [#before-you-start]

* You need the **Admin** role.
* The storage account and container that hold the logs, in Azure or Azure Government.
* A managed identity for Foxborne to read with. The console's example is `foxborne-reader`.
* Rights to assign Azure roles on the container, for example as an Owner or User Access Administrator.

## Give the identity read access [#give-the-identity-read-access]

Assign the built-in Storage Blob Data Reader role to the managed identity, scoped to the container. The role lists and reads blobs, and it cannot write or delete them.

In the Azure portal, open the container and add the role assignment under Access control (IAM). Scope it to the container rather than the whole storage account, so the identity reads nothing else. Azure Government uses the same role and the same steps.

The connection test in the next section checks the result: it attempts a write and a delete, and confirms that both are refused.

## Connect the container [#connect-the-container]

<Steps>
  <Step title="Choose Azure Blob Storage">
    In **Sources**, select **Add source**, pick **Azure Blob Storage** under **Object storage** and select **Continue**. The card reads &#x2A;*A container in your subscription, including Azure Government. Managed identity.**
  </Step>

  <Step title="Fill in the fields">
    | Field                             | Example in the console                     | What to enter                                             |
    | --------------------------------- | ------------------------------------------ | --------------------------------------------------------- |
    | **Name**                          | For example: Fleet log archive, west range | A name the team will recognize.                           |
    | **Storage account and container** | `hfrlogs/flight-logs`                      | The storage account name, a slash and the container name. |
    | **Managed identity**              | `foxborne-reader`                          | The managed identity you gave read access.                |
    | **File pattern**                  | `*.ulg`                                    | Which blobs to read.                                      |

    If the blob paths name the vehicle, mark that part with `{vehicle}`, as in the pattern `{vehicle}/{yyyy-mm-dd}/*.ulg`. With a pattern such as `*.ulg`, Foxborne matches each flight log by the MAVLink system ID it records.
  </Step>

  <Step title="Test the connection">
    Select **Test connection**. Four checks appear one after another:

    | Check                    | Result                                             |
    | ------------------------ | -------------------------------------------------- |
    | **Resolve and connect.** | **Reached the location from the Foxborne worker.** |
    | **List objects.**        | **Read access confirmed.**                         |
    | **Attempt a write.**     | **Refused, as it should be.**                      |
    | **Attempt a delete.**    | **Refused, as it should be.**                      |
  </Step>

  <Step title="Add the source">
    Select **Add source**. The toast names the source and says &#x2A;*The first sync is running.**
  </Step>
</Steps>

## Check the result [#check-the-result]

* The source appears in **Connections** with **Read-only, verified** under **Access** and **Healthy** under **Status**.
* The drawer shows the account and container under **Location**, the managed identity under **Credential** and your pattern under **Matches**.
* **Guarantees** states &#x2A;*Read-only. The last connection test confirmed that writes and deletes are refused.**
* The audit log records **Added source** with a detail such as **Azure Blob Storage, read-only test passed**.

## Troubleshoot [#troubleshoot]

* **Status shows Needs attention or Error.** Open the source's drawer and read the note at the top.
* **Files land on the wrong vehicle.** Check where `{vehicle}` sits in the pattern against the real blob paths. Or leave it out, and let the system ID in each flight log decide.
* **Runs from the container show Partial.** The container holds flight logs only. Bring in the journal and receive log through a collector, another source or **Import files**.

## Next [#next]

* [Connect a storage source](/collect/sources) covers every source type, the drawer and its actions.
* [Deploy in Azure Government](/deploy/azure-government) covers running Foxborne in Azure Government.
* [Supported file formats](/collect/formats) lists the formats a source can hold.