Breadcrumbs

Create an Azure Service Principal

Overview

This article applies only to Service Principal authentication. If you are using Account Key authentication, see View Azure Storage Account Access Keys.

If you are using Service Principal authentication, you must create a Microsoft Entra application and obtain its credentials before configuring an Azure Blob Storage connection in Yarken.

A Service Principal allows Yarken to securely authenticate with Azure Blob Storage using Microsoft Entra ID instead of a Storage Account Access Key. This authentication method is recommended for organizations that manage Azure resources using role-based access control (RBAC).

After creating the Service Principal, you will use the following credentials when creating the Azure Blob Storage connection in Yarken:

  • Tenant ID

  • Client ID

  • Client Secret

Before you begin

Ensure that you have:

  • Access to the Azure portal.

  • Permission to register applications in Microsoft Entra ID.

  • Permission to assign roles to Azure resources.

  • An Azure Storage Account configured for billing exports.

Step 1. Register an application

  1. Sign in to the Azure portal.

  2. Search for and open Microsoft Entra ID.

  3. Select App registrations.

  4. Click + New registration.

The Register an application page opens.

  1. Enter the following information.

Field

Description

Name

Enter a descriptive name for the application (for example, Yarken Azure Blob Storage).

Supported account types

Select the appropriate option based on your organization's requirements.

Redirect URI

Leave blank unless required by your organization's policies.

  1. Click Register.

Azure creates the application and opens its Overview page.

Step 2. Obtain the Tenant ID and Client ID

After the application is registered:

  1. On the Overview page, copy the following values.

Credential

Description

Application (Client) ID

Used as the Client ID when creating the Azure Blob Storage connection in Yarken.

Directory (Tenant) ID

Used as the Tenant ID when creating the Azure Blob Storage connection in Yarken.

Store these values securely.

Step 3. Create a Client Secret

  1. In the left navigation menu, select Certificates & secrets.

  2. Under Client secrets, click + New client secret.

  3. Enter a description.

  4. Select an expiration period according to your organization's security policy.

  5. Click Add.

Azure creates the Client Secret.

  1. Copy the Value of the Client Secret.

Azure displays the Client Secret value only once. Store it securely before leaving the page.

Step 4. Assign Storage Account permissions

The Service Principal must have sufficient permissions to access the Blob container. Without the appropriate Azure role assignments, Yarken cannot retrieve billing export files.

Consult your Azure administrator to determine the appropriate role for your organization's security policies.

  1. Open the Azure Storage Account.

  2. Select Access Control (IAM).

  3. Click Add role assignment.

  4. Assign the required Azure role to the Service Principal.

  5. Save the changes.

Verify the configuration

Before proceeding, confirm that you have the following credentials.

  • Storage Account Name

  • Tenant ID Client ID

  • Client Secret

  • Container Name

These credentials are required when creating an Azure Blob Storage connection using Service Principal authentication.

Result

You have successfully created a Microsoft Entra application and obtained the credentials required to authenticate Azure Blob Storage using a Service Principal.

Next steps

Continue to Configure the Azure Blob Pipeline in Yarken to create the Azure Blob Storage connection using the Service Principal credentials.

Related content

Azure configuration

Yarken Pipelines