Search code examples
azure-active-directoryazure-data-factoryazure-blob-storage

Calling Azure storage account REST APIs using Azure Data Factory Managed Identity

We are hoping to make a call to the "Blob Containers - Create" api endpoint i.e. https://learn.microsoft.com/en-us/rest/api/storagerp/blob-containers/create?view=rest-storagerp-2023-01-01&tabs=HTTP from the Azure data factory pipeline web activity.

While this typically works seamlessly with a dedicated Azure AD application registered with a secret, our aim is to execute the call using the Managed Identity of the Data Factory. The ADF's Managed Identity already holds the storage blob data contributor role assigned on the storage account.

Given that the REST endpoint necessitates the mandatory authorization header requiring a bearer token issued by Azure AD, we are currently encountering an issue in obtaining it for ADF's managed identity.

Any assistance on this will be appreciated.

Solution

  • Note that, there is no need to generate access token separately while using managed identity authentication.

    Initially, I added Storage Blob Data Contributor role to ADF managed identity under storage account like this:

    enter image description here

    In your Azure data factory pipeline web activity, use below parameter values in Settings tab:

    URL : https://management.azure.com/subscriptions/subId/resourceGroups/rg_name/providers/Microsoft.Storage/storageAccounts/storacc/blobServices/default/containers/sricontainer01?api-version=2023-01-01

    Method: PUT

    Body: {"null": "null"}

    Authentication: System Assigned Managed Identity

    Resource: https://management.azure.com

    Headers: Content-Type : application/json

    enter image description here

    When I ran the pipeline, I got the response with Succeeded status as below:

    enter image description here

    To confirm that, I checked the same in Portal where container created successfully in storage account like this:

    enter image description here