> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Azure access

> Grant e6data keyless read access to your Azure storage - provision a User-Assigned Managed Identity and register it as a Storage Credential.

e6data reads your ADLS Gen2 data **read-only and keyless** through Azure Workload Identity. You provision a **User-Assigned Managed Identity** with a federated credential and the **Storage Blob Data Reader** role, then register its Tenant ID and Client ID as a **Storage Credential** in e6data. No client secret is used.

## Provision the Managed Identity

You can create the identity four ways. In the e6data setup wizard, choose **Microsoft Azure**, then a deployment method:

| Method | How it works |
| - | - |
| **ARM Template** | The wizard generates an `e6data-azure-arm.json` you deploy from the Azure Portal (**Deploy to Azure**), filling the form (subscription, resource group, region, identity name, issuer URL, namespace, service account, storage account). |
| **Azure CLI** | Enter your config in the wizard to generate an `az` script, then run it in an authenticated CLI session. |
| **Terraform** | Enter the same inputs to generate an `azurerm` script, then `terraform init` and `terraform apply`. |
| **Manual** | Do the Portal steps below yourself. |

### Manual steps (Azure Portal)

1. **Create a User-Assigned Managed Identity** - Managed Identities → **+ Create** (subscription, resource group, name, region) → **Review + Create**.
2. **Add a federated credential** - on the identity, **Federated credentials → + Add** → scenario **Kubernetes accessing Azure resources** → enter the Cluster Issuer URL, Namespace, and Service Account (provided by e6data) → **Add**.
3. **Assign RBAC** - on the storage account, **Access control (IAM) → + Add role assignment** → **Storage Blob Data Reader** → principal type **Managed Identity** → select the identity → **Review + Assign**.
4. **Retrieve identity info** - from the identity's **Overview**, note the **Client ID** and **Tenant ID**.

<Info>
  Once you register the identity (next section), e6data deploys a pod in its managed Serverless subscription that uses the federated credential to read your storage. Because access is keyless and federated, no secret ever leaves your tenant.
</Info>

## Register the Storage Credential

A Storage Credential is a reusable, keyless connection you create once and reuse across catalogs.

1. In the Compute Plane, go to **Settings → Storage Credentials** and select **+ New Credential**.
2. Enter a **Name** (for example, `azure-shared-cred`) and optional description.
3. Enter the **Tenant ID** and **Client ID** (and optionally the storage account name). Leave **Client Secret** empty - access is keyless.
4. Select **Create**. The credential shows **Connected**.

## See also

* [Connect ADLS and a catalog](/platform/deploy/azure-serverless/connect-adls-and-catalog) - use this credential in a catalog.
* [Troubleshooting](/platform/deploy/azure-serverless/troubleshooting) - identity and access errors.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.