> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/deployment/azure-serverless/configure-azure-access.md).

# Configure Azure access

Grant e6data keyless read access to your Azure storage - provision a User-Assigned Managed Identity and register it as a Storage Credential.

e6data reads your ADLS Gen2 data **read-only and keyless** through Azure Workload Identity. You provision a **User-Assigned Managed Identity** with a federated credential and the **Storage Blob Data Reader** role, then register its Tenant ID and Client ID as a **Storage Credential** in e6data. No client secret is used.

## Provision the Managed Identity

You can create the identity four ways. In the e6data setup wizard, choose **Microsoft Azure**, then a deployment method:

| Method           | How it works                                                                                                                                                                                                                             |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **ARM Template** | The wizard generates an `e6data-azure-arm.json` you deploy from the Azure Portal (**Deploy to Azure**), filling the form (subscription, resource group, region, identity name, issuer URL, namespace, service account, storage account). |
| **Azure CLI**    | Enter your config in the wizard to generate an `az` script, then run it in an authenticated CLI session.                                                                                                                                 |
| **Terraform**    | Enter the same inputs to generate an `azurerm` script, then `terraform init` and `terraform apply`.                                                                                                                                      |
| **Manual**       | Do the Portal steps below yourself.                                                                                                                                                                                                      |

### Manual steps (Azure Portal)

1. **Create a User-Assigned Managed Identity** - Managed Identities → **+ Create** (subscription, resource group, name, region) → **Review + Create**.
2. **Add a federated credential** - on the identity, **Federated credentials → + Add** → scenario **Kubernetes accessing Azure resources** → enter the Cluster Issuer URL, Namespace, and Service Account (provided by e6data) → **Add**.
3. **Assign RBAC** - on the storage account, **Access control (IAM) → + Add role assignment** → **Storage Blob Data Reader** → principal type **Managed Identity** → select the identity → **Review + Assign**.
4. **Retrieve identity info** - from the identity's **Overview**, note the **Client ID** and **Tenant ID**.

{% hint style="info" %}
Once you register the identity (next section), e6data deploys a pod in its managed Serverless subscription that uses the federated credential to read your storage. Because access is keyless and federated, no secret ever leaves your tenant.
{% endhint %}

## Register the Storage Credential

A Storage Credential is a reusable, keyless connection you create once and reuse across catalogs.

1. In the Compute Plane, go to **Settings → Storage Credentials** and select **+ New Credential**.
2. Enter a **Name** (for example, `azure-shared-cred`) and optional description.
3. Enter the **Tenant ID** and **Client ID** (and optionally the storage account name). Leave **Client Secret** empty - access is keyless.
4. Select **Create**. The credential shows **Connected**.

## See also

* [Connect ADLS and a catalog](/query-engine/guides/deployment/azure-serverless/connect-adls-and-catalog.md) - use this credential in a catalog.
* [Troubleshooting](/query-engine/guides/deployment/azure-serverless/troubleshooting.md) - identity and access errors.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/deployment/azure-serverless/configure-azure-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.