Azure Blob Storage

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	no extra properties
required.account_url	string	Yes	Azure Blob account URL (for example, https://<account>.blob.core.windows.net)	—	format uri
required.container	string	Yes	Azure Blob container name	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	No	Optional Azure credentials. Leave empty to use managed identity/default credential chain.	—	no extra properties
masked.azure_account_key	string	No	Azure storage account key	—	—
masked.azure_client_id	string	No	Azure Entra client ID (service principal auth)	—	—
masked.azure_client_secret	string	No	Azure Entra client secret (service principal auth)	—	—
masked.azure_connection_string	string	No	Azure storage connection string (takes precedence over other auth fields)	—	—
masked.azure_sas_token	string	No	Azure SAS token	—	—
masked.azure_tenant_id	string	No	Azure Entra tenant ID (service principal auth)	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	—	—	no extra properties
optional.connection.max_keys_per_page	integer	No	Maximum blobs requested per list page	200	min 1, max 1000
optional.connection.max_object_bytes	integer	No	Maximum bytes downloaded per blob for MIME detection and text extraction	5242880	min 1024, max 52428800
optional.connection.request_timeout_seconds	number	No	Network timeout in seconds for list/download operations	30	min 1, max 300
optional.scope	object	No	Object scope and filtering controls.	—	no extra properties
optional.scope.exclude_extensions	array	No	Optional extension denylist	—	—
optional.scope.exclude_extensions[]	string	No	—	—	—
optional.scope.include_content_preview	boolean	No	Download object bytes to infer MIME and extract detector-ready text previews	true	—
optional.scope.include_empty_objects	boolean	No	Include zero-byte objects in extraction results	false	—
optional.scope.include_extensions	array	No	Optional extension allowlist (for example, .pdf, .csv, .parquet)	—	—
optional.scope.include_extensions[]	string	No	—	—	—
optional.scope.include_object_metadata	boolean	No	Attach provider metadata (etag, size, content-type hints, timestamps) to asset checksums	true	—
optional.scope.prefix	string	No	Object key prefix filter (for example, exports/2026/)	—	—

Extracted Metadata

File

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
page_count	integer	No	Number of pages (pdf)
paragraph_count	integer	No	Number of paragraphs (docx)
table_count	integer	No	Number of tables (docx)
row_count	integer	No	Number of data rows
columns	object[]	No	Columns as {name, type} objects (type may be empty for csv/xlsx)
encoding	string	No	Detected character encoding
json_root_type	string	No	Root JSON type: object, array, or scalar
top_level_keys	integer	No	Number of top-level keys when the root is an object
array_length	integer	No	Length when the root is an array
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
etag	string	No	Object entity tag
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Image

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
provider	string	No	Storage provider label
object_key	string	No	Object key/path
etag	string	No	Object entity tag
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Audio

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Video

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Archive

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
etag	string	No	Object entity tag
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Examples

Azure Blob container scan

Scan an Azure Blob container using connection string authentication

Config Payload

{
  "type": "AZURE_BLOB_STORAGE",
  "required": {
    "account_url": "https://your-account.blob.core.windows.net",
    "container": "your-container"
  },
  "masked": {
    "azure_connection_string": "DefaultEndpointsProtocol=https;AccountName=your-account;AccountKey=your-key;EndpointSuffix=core.windows.net"
  },
  "optional": {
    "scope": {
      "include_content_preview": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekly",
  "cron": "17 3 * * 0",
  "timezone": "UTC"
}

Azure Blob document compliance scan

Scan documents in a container with prefix filter, excluding images, with PII detection

Config Payload

{
  "type": "AZURE_BLOB_STORAGE",
  "required": {
    "account_url": "https://your-account.blob.core.windows.net",
    "container": "your-container"
  },
  "masked": {
    "azure_account_key": "your-account-key"
  },
  "optional": {
    "scope": {
      "prefix": "documents/",
      "exclude_extensions": [
        ".png",
        ".jpg",
        ".gif"
      ],
      "include_content_preview": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "30 1 * * *",
  "timezone": "UTC"
}