Azure Blob Storage

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	no extra properties
required.account_url	string	Yes	Azure Blob account URL (for example, https://<account>.blob.core.windows.net)	—	format uri
required.container	string	Yes	Azure Blob container name	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	No	Optional Azure credentials. Leave empty to use managed identity/default credential chain.	—	no extra properties
masked.azure_account_key	string	No	Azure storage account key	—	—
masked.azure_client_id	string	No	Azure Entra client ID (service principal auth)	—	—
masked.azure_client_secret	string	No	Azure Entra client secret (service principal auth)	—	—
masked.azure_connection_string	string	No	Azure storage connection string (takes precedence over other auth fields)	—	—
masked.azure_sas_token	string	No	Azure SAS token	—	—
masked.azure_tenant_id	string	No	Azure Entra tenant ID (service principal auth)	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	—	—	no extra properties
optional.connection.max_keys_per_page	integer	No	Maximum blobs requested per list page	200	min 1, max 1000
optional.connection.max_object_bytes	integer	No	Maximum bytes downloaded per blob for MIME detection and text extraction	5242880	min 1024, max 52428800
optional.connection.request_timeout_seconds	number	No	Network timeout in seconds for list/download operations	30	min 1, max 300
optional.scope	object	No	Object scope and filtering controls.	—	no extra properties
optional.scope.exclude_extensions	array	No	Optional extension denylist	—	—
optional.scope.exclude_extensions[]	string	No	—	—	—
optional.scope.include_content_preview	boolean	No	Download object bytes to infer MIME and extract detector-ready text previews	true	—
optional.scope.include_empty_objects	boolean	No	Include zero-byte objects in extraction results	false	—
optional.scope.include_extensions	array	No	Optional extension allowlist (for example, .pdf, .csv, .parquet)	—	—
optional.scope.include_extensions[]	string	No	—	—	—
optional.scope.include_object_metadata	boolean	No	Attach provider metadata (etag, size, content-type hints, timestamps) to asset checksums	true	—
optional.scope.prefix	string	No	Object key prefix filter (for example, exports/2026/)	—	—

Extracted Metadata

File

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
page_count	integer	No	Number of pages (pdf)
paragraph_count	integer	No	Number of paragraphs (docx)
table_count	integer	No	Number of tables (docx)
row_count	integer	No	Number of data rows
columns	object[]	No	Columns as {name, type} objects (type may be empty for csv/xlsx)
encoding	string	No	Detected character encoding
json_root_type	string	No	Root JSON type: object, array, or scalar
top_level_keys	integer	No	Number of top-level keys when the root is an object
array_length	integer	No	Length when the root is an array
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
etag	string	No	Object entity tag

Image

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
source_hash	string	Yes	Hash of the parent object asset
location	string	Yes	Location of the embedded image within the parent

Audio

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path

Video

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path

Examples

Azure Blob container scan

Scan an Azure Blob container using connection string authentication

Config Payload

{
  "type": "AZURE_BLOB_STORAGE",
  "required": {
    "account_url": "https://your-account.blob.core.windows.net",
    "container": "your-container"
  },
  "masked": {
    "azure_connection_string": "DefaultEndpointsProtocol=https;AccountName=your-account;AccountKey=your-key;EndpointSuffix=core.windows.net"
  },
  "optional": {
    "scope": {
      "include_content_preview": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekly",
  "cron": "17 3 * * 0",
  "timezone": "UTC"
}

Azure Blob document compliance scan

Scan documents in a container with prefix filter, excluding images, with PII detection

Config Payload

{
  "type": "AZURE_BLOB_STORAGE",
  "required": {
    "account_url": "https://your-account.blob.core.windows.net",
    "container": "your-container"
  },
  "masked": {
    "azure_account_key": "your-account-key"
  },
  "optional": {
    "scope": {
      "prefix": "documents/",
      "exclude_extensions": [
        ".png",
        ".jpg",
        ".gif"
      ],
      "include_content_preview": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "30 1 * * *",
  "timezone": "UTC"
}