Configure Azure access

Grant e6data keyless read access to your Azure storage - provision a User-Assigned Managed Identity and register it as a Storage Credential.

e6data reads your ADLS Gen2 data read-only and keyless through Azure Workload Identity. You provision a User-Assigned Managed Identity with a federated credential and the Storage Blob Data Reader role, then register its Tenant ID and Client ID as a Storage Credential in e6data. No client secret is used.

Provision the Managed Identity

You can create the identity four ways. In the e6data setup wizard, choose Microsoft Azure, then a deployment method:

Method	How it works
ARM Template	The wizard generates an e6data-azure-arm.json you deploy from the Azure Portal (Deploy to Azure), filling the form (subscription, resource group, region, identity name, issuer URL, namespace, service account, storage account).
Azure CLI	Enter your config in the wizard to generate an az script, then run it in an authenticated CLI session.
Terraform	Enter the same inputs to generate an azurerm script, then terraform init and terraform apply.
Manual	Do the Portal steps below yourself.

Manual steps (Azure Portal)

1. Create a User-Assigned Managed Identity - Managed Identities → + Create (subscription, resource group, name, region) → Review + Create.
2. Add a federated credential - on the identity, Federated credentials → + Add → scenario Kubernetes accessing Azure resources → enter the Cluster Issuer URL, Namespace, and Service Account (provided by e6data) → Add.
3. Assign RBAC - on the storage account, Access control (IAM) → + Add role assignment → Storage Blob Data Reader → principal type Managed Identity → select the identity → Review + Assign.
4. Retrieve identity info - from the identity's Overview, note the Client ID and Tenant ID.

Once you register the identity (next section), e6data deploys a pod in its managed Serverless subscription that uses the federated credential to read your storage. Because access is keyless and federated, no secret ever leaves your tenant.

Register the Storage Credential

A Storage Credential is a reusable, keyless connection you create once and reuse across catalogs.

1. In the Compute Plane, go to Settings → Storage Credentials and select + New Credential.
2. Enter a Name (for example, azure-shared-cred) and optional description.
3. Enter the Tenant ID and Client ID (and optionally the storage account name). Leave Client Secret empty - access is keyless.
4. Select Create. The credential shows Connected.

See also

• Connect ADLS and a catalog - use this credential in a catalog.
• Troubleshooting - identity and access errors.