> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Blob Storage

The Azure Blob Storage config source loads Orchestrator configuration from a blob stored in an Azure Storage container. The source is configured entirely through the `MAVERICS_AZURE_CONFIG` environment variable.

> [!NOTE]
>
> **Console terminology:** In the Maverics Console, Orchestrator instances and
> configuration delivery are managed through **Deployments**. When working directly
> with YAML, configuration is managed as files delivered via the `-config` flag or
> `MAVERICS_CONFIG` environment variable.

## Prerequisites

* **An active Azure account** -- with access to the storage account and container where configuration is stored
* **A storage account and container** -- already provisioned in Azure (see the [Console Azure Blob Storage](/reference/console/config-publishing/azure-blob#azure-setup) setup guide)
* **A SAS token with read access** -- generated with List and Read permissions on the container (see steps below)

## Overview

When the `MAVERICS_AZURE_CONFIG` environment variable is set, the Orchestrator fetches its YAML configuration from the specified Azure storage account, container, and blob path. The variable contains a JSON payload with connection details and SAS token authentication. The Orchestrator supports ETag-based change detection for automatic hot-reload.

## Use Cases

* **Azure-native deployments** -- store configuration in Azure Storage alongside other Azure infrastructure resources
* **Azure DevOps pipelines** -- publish validated configuration to Blob Storage as part of Azure DevOps CI/CD workflows
* **Multi-region with Azure** -- leverage Azure Storage geo-replication to distribute configuration across regions

## Generating a SAS Token

**1. Navigate to Your Container**

In the Azure portal, go to your storage account and select **Containers** under **Data storage**.

Select the container that holds (or will hold) Orchestrator configuration.

**2. Generate the SAS Token**

Click the three-dot menu (or right-click) on the container and select **Generate SAS**.

Set **Signing method** to **Account key** and **Signing key** to **Key 1**.

Under **Permissions**, select **List** and **Read** only (the Orchestrator only needs to read configuration, not write it).

Set an appropriate expiry date.

Click **Generate SAS token and URL**.

Copy the **Blob SAS token** value (starts with `sv=`) -- use this as the `token` value in `MAVERICS_AZURE_CONFIG`.

## Configuration

The Azure Blob config source is configured via the `MAVERICS_AZURE_CONFIG` environment variable with a JSON payload:

```bash theme={null}
export MAVERICS_AZURE_CONFIG='{
  "account": "mystorageaccount",
  "container": "config",
  "token": "<sas-token>",
  "configurationFilePath": "path/to/config"
}'
maverics
```

## Configuration Reference

The `MAVERICS_AZURE_CONFIG` JSON payload supports the following fields:

| Field | Type | Required | Description |
| - | - | - | - |
| `account` | string | Yes | Azure storage account name |
| `container` | string | Yes | Blob container name |
| `token` | string | Yes | SAS token for authentication |
| `configurationFilePath` | string | No | Directory path prefix within the container where the config bundle is stored. The Orchestrator appends `maverics.tar.gz` to this path. If omitted, the bundle is expected at the container root. |
| `storageDomain` | string | No | Storage domain suffix (default: `core.windows.net`). The Orchestrator constructs URLs as `https://{account}.blob.{storageDomain}/...`. For Azure Government, use `core.usgovcloudapi.net`. |

**ETag-based hot-reload:** When `MAVERICS_RELOAD_CONFIG=true` is set, the Orchestrator periodically checks the blob's ETag. When the ETag changes (indicating the blob was updated), the Orchestrator reloads the configuration automatically.

## Full Environment Example

A complete `maverics.env` file for an Orchestrator using Azure Blob Storage as its config source:

```bash maverics.env theme={null}
MAVERICS_DEBUG_MODE=true
MAVERICS_HTTP_ADDRESS=:443
MAVERICS_TLS_SERVER_CERT_FILE=your-cert.pem
MAVERICS_TLS_SERVER_KEY_FILE=your-private_key.pem
MAVERICS_RELOAD_CONFIG=true
MAVERICS_POLLING_INTERVAL_SECONDS=30
MAVERICS_BUNDLE_PUBLIC_KEY_FILE=./public_key.pem
MAVERICS_AZURE_CONFIG='{"token": "sv=2021-...", "account": "exampleStorage", "container": "exampleContainer", "configurationFilePath": "folder1/folder2"}'
```

Replace the placeholder values with your actual certificate paths, storage account name, container name, and SAS token.

## Troubleshooting

* **Authentication failed** -- verify the SAS token has not expired. SAS tokens have a configurable expiration time. Generate a new token with read access to the blob.
* **Container not found** -- confirm the `account` and `container` values are correct. Container names are case-sensitive and must be lowercase.
* **Custom domain** -- if using Azure Government or a custom storage domain, set the `storageDomain` field (e.g., `core.usgovcloudapi.net`). The Orchestrator prepends `blob.` automatically in the URL.
* **Config not reloading** -- ensure `MAVERICS_RELOAD_CONFIG=true` is set. Check Orchestrator logs for ETag change detection messages.

## Related Pages

> **[Config Sources](/reference/orchestrator/configuration/config-sources)**
>
> Overview of all configuration sources

> **[Amazon S3](/reference/orchestrator/configuration/config-sources/s3)**
>
> Load config from AWS S3

> **[Configuration Reference](/reference/orchestrator/configuration)**
>
> Complete configuration field reference

> **[Azure Blob Deployment Provider](/reference/console/config-publishing/azure-blob)**
>
> Console-side Azure Blob Storage setup and SAS token generation