[QUERY] How to create a blob client using EntraAppIds with Federated credentials?

[eddynaka]

Library name and version

Azure.Storage.Blob

Query/Question

Hello!

Given an Azure Entra App Id with federated credentials, how do I properly create it and use it to connect into AzureStorage accounts to successfully create a blobclient?

I tried to use the DefaultAzureCredentials with the ClientId from my app, but I'm not sure if my issuer was right, since I didn't find any documentation.

Environment

No response

[jsquire]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[christothes]

Hi @eddynaka -
Could you describe more about how you are configuring your credential and what specific errors you are getting?

[github-actions]

Hi @eddynaka. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[eddynaka]

Hello @christothes ,

Since there is not much documentation available, here is what I did:

1. Created an Entra App
2. Created a federated credential with the following options: Other, Issuer=https://[Instance]/[Domain]/{TenantId}/v2.0/, Subject=AppId
3. Gave Blob Owner permission to the entra app
4. Tried to create using DefaultAzureCredentials with the ClientId to authenticate to the blob

Given those steps, it fails with either issuer not found or unauthorized.
I also tried to use MSAL but didn't work as well.

[christothes]

What is the issuer you are using for the federated credential? That issuer should have the details for you to fill in.

Regarding documentation - here are the general docs for configuring this - https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation