How to Give an Azure App Passwordless Access to Blob Storage

Enable an app’s managed identity, assign the smallest suitable Blob data role, and test access without storing a key.

Plan the access

A system-assigned managed identity gives an Azure-hosted app its own Microsoft Entra identity. Azure manages the identity’s credential lifecycle. Choose a Blob data role based on the operations the app actually needs: Storage Blob Data Reader for read-only access, or Storage Blob Data Contributor for read, write, and delete. Where practical, scope the assignment to a container instead of the entire storage account. The administrator creating it needs permission to write role assignments at that scope.

Enable the identity

1. In the Azure portal, open the App Service or other supported resource that hosts the application.
2. Open Identity, turn the system-assigned identity On, and save.
3. Record the identity’s principal ID for troubleshooting; it is an identifier, not a secret.

Grant Blob data access

1. Open the intended storage account or container and select Access control (IAM) → Add → Add role assignment.
2. Choose Storage Blob Data Reader if the app only reads, or Storage Blob Data Contributor if it must write or delete.
3. For Assign access to, select Managed identity, then select the app’s system-assigned identity.
4. Review the scope, role, and identity; choose Review + assign. Allow time for the assignment to take effect.

Update and test the application

Use an Azure SDK identity credential such as DefaultAzureCredential with the Blob service URL, instead of embedding an account key or connection string. Test the exact operations the app requires in its hosted environment. Developers testing locally may need a separate role assignment to their own accounts; that does not give the hosted app additional permissions.

Common mistake

An Azure management role such as Reader on the storage account does not replace a Blob data role. If an operation returns an authorization error, check the app identity, role, and scope. Review the assignment periodically and remove permissions the app no longer needs.

Sources

Microsoft Learn: Configure passwordless connections between services; Microsoft Learn: Assign a role for Blob data access; Microsoft Learn: Steps to assign an Azure role.