> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Azure Blob Storage OAuth 2.0 (Entra ID) connector profile – StackOne setup guide > Set up the OAuth 2.0 (Entra ID) connector profile for Azure Blob Storage in StackOne. One-time admin setup required before your users can link Azure Blob Storage accounts via Hub. You need at least the Application Developer role in Microsoft Entra ID to register an application, and a Global Administrator (or Privileged Role Administrator) to grant admin consent for the Azure Storage permission. Assigning the Azure RBAC role on the storage account requires Owner or User Access Administrator on that account.
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Register an application in Microsoft Entra ID

Create an app registration in the Microsoft Entra admin center to obtain the OAuth 2.0 credentials StackOne uses to connect Azure Blob Storage.

Sign in to the Microsoft Entra admin center with an account that has at least the Application Developer role.

  • If you manage more than one tenant, confirm you are in the correct directory using the Settings (gear) icon before continuing.

In the left sidebar, go to Entra ID > App registrations. On the App registrations page, click New registration and complete the Register an application form.

  • Name: enter a name you will recognise, for example `StackOne Azure Blob Storage`.
  • Under Supported account types, select the single-tenant option — shown as Single tenant only in the current portal, or Accounts in this organizational directory only (single tenant) in the classic form.
  • Leave Redirect URI (optional) empty for now — you will add it in the next section.
  • Click Register.
The App registrations page with the New registration button highlighted

After registration you land on the app's Overview page. From the Essentials panel, copy these two values and store them securely:

  • Application (client) ID — the public identifier of your app. Paste it into the Client ID field in the StackOne Connector profile.
  • Directory (tenant) ID — your Microsoft Entra tenant identifier. Paste it into the Tenant ID field in the StackOne Connector profile.
The app Overview page showing the Application (client) ID and Directory (tenant) ID

Configure the redirect URI

Register StackOne's OAuth 2.0 callback URL so Microsoft Entra can return the authorization code to StackOne.

In the app's left menu, open Authentication (Preview). On the Redirect URI configuration tab, click Add Redirect URI, then under Web applications choose Web.

  • In the Redirect URI field, enter StackOne's callback URL exactly: `https://api.stackone.com/connect/oauth2/azureblobstorage/callback`
  • Click Configure to save.
  • If your portal shows the older Authentication page instead of the Preview experience, under Platform configurations click Add a platform, select Web, enter the same URL, and click Configure.
The Add Redirect URI panel with the Web platform and the StackOne callback URL entered

Configure API permissions

Grant the app delegated access to Azure Storage and have an administrator consent to it.

Enables actions: Abort Copy Blob, Append Block, Copy Blob, Create Blob Snapshot, Create Container, Delete Blob, Delete Container, Download Blob, Find Blobs By Tags, Get Blob Metadata, Get Blob Properties, Get Blob Service Properties, Get Blob Tags, Get Container ACL, Get Container Metadata, Get Container Properties, List Blobs, List Containers, Set Blob Metadata, Set Blob Properties, Set Blob Service Properties, Set Blob Tags, Set Blob Tier, Set Container ACL, Set Container Metadata, Undelete Blob, Upload Blob

In the app's left menu, open API permissions, click Add a permission, then select Azure Storage.

  • Choose Delegated permissions.
  • Select user\_impersonation (Access Azure Storage).
  • Click Add permissions.
  • You do not need to add offline\_access here — StackOne requests it automatically during sign-in to obtain refresh tokens, and it requires no Entra ID configuration.
The Request API permissions panel with Delegated permissions and user_impersonation selected

Back on the API permissions page, click Grant admin consent for \[your tenant] and confirm with Yes. The user\_impersonation permission should then show a green Granted status.

  • Admin consent must be granted by a Global Administrator or Privileged Role Administrator.
The Configured permissions table with the Grant admin consent button highlighted

Create a client secret

Generate the secret StackOne uses together with the Client ID to authenticate the app registration.

In the app's left menu, open Certificates & secrets, stay on the Client secrets tab, and click New client secret.

  • Enter a Description, for example `StackOne Integration`.
  • Choose an expiry under Expires (for example the recommended 180 days).
  • Click Add.
The Certificates & secrets page with the New client secret button highlighted

Copy the secret's Value immediately and paste it into the Client Secret field in the StackOne Connector profile.

  • The Value is shown only once and cannot be retrieved after you leave this page — copy it now. Do not copy the Secret ID, which is a different value.
  • The Scopes field in the StackOne Connector profile is optional. Leave it empty to use the defaults (`https://storage.azure.com/user_impersonation` and `offline_access`); only set it if you need to request different scopes.
The client secret Value column shown once after the secret is created

Assign an Azure RBAC role on the storage account

Microsoft Entra authenticates the user, but Azure Storage authorizes each operation through an Azure RBAC role assigned on the storage account. Assign the role to the user who will authorize the StackOne connection in the Azure portal.

In the Azure portal, search for Storage accounts in the top search bar and select the storage account you want to connect. Then select Access Control (IAM) in the left sidebar and click Add > Add role assignment.

  • On the Role tab, under Job function roles, search for and select Storage Blob Data Contributor — it grants read, write, and delete access to blobs and containers, which covers most StackOne actions. Then click Next.
  • On the Members tab, keep Assign access to set to User, group, or service principal, click Select members, and choose the user who will connect StackOne.
  • Click Review + assign to finish.
  • If StackOne will use blob tag actions (Get Blob Tags, Set Blob Tags, Find Blobs By Tags), assign Storage Blob Data Owner instead — it is a superset of Storage Blob Data Contributor.
The Add role assignment blade with the Storage Blob Data Contributor role selected
## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Azure Blob Storage: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  • Click + Connector Profile
  • Search for and select Azure Blob Storage
  • Select Type as OAuth 2.0 (Entra ID)
  • Fill out the fields using details retrieved from your provider:
    • Tenant ID
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
 Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Azure Blob Storage.