Azure Storage

We only support hierarchical namespaces, make sure the storage container is configured as such.

Scheme

The scheme you can use to access your files in Azure Blob Storage is

azure://

Configuration

To get access to your Azure storage files you need to configure a few things:

The name of your storage account in Azure
The key of your storage account in Azure

You can find both in the Storage Accounts section of your Azure portal.

A file block size : This needs to be a multiple of 512 bytes.

All 3 options can be set in either the Hop GUI options dialog (Menu: Tools / Options) or using the following Hop Conf (hop-conf.sh or hop-conf.bat) command line options:

      -aza, --azure-account=<account>
                            The account to use for the Azure VFS
      -azi, --azure-block-increment=<blockIncrement>
                            The block increment size for new files on Azure,
                              multiples of 512 only.
      -azk, --azure-key=<key>
                            The key to use for the Azure VFS

Once done you will see an azure entry in the central hop-config.json file:

{
  "azure" : {
    "account" : "storage-account-name",
    "key" : "a/key-comprised-of-a-long-set-of-characters-and-numbers==",
    "blockIncrement" : "1024"
  }
}

Authentication types

An Azure connection in the metadata perspective can authenticate in three ways, selected with the Authentication Type option. Connections that predate this option keep working: an empty authentication type is treated as Key.

Authentication Type What you provide When to use it

Authentication Type	What you provide	When to use it
`Key`	The storage account key	Simplest to set up. The key grants full, non-expiring access to the whole storage account.
`Managed Identity`	Nothing	Runs on Azure with a managed identity, or locally through the Azure CLI (`az login`) or the `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET` environment variables. The identity needs a role such as `Storage Blob Data Contributor`.
`SAS Token`	A shared access signature	Access is limited to the resources, permissions and expiry encoded in the signature, so it avoids handing out a long lived account key.

Key

The storage account key

Simplest to set up. The key grants full, non-expiring access to the whole storage account.

Managed Identity

Nothing

Runs on Azure with a managed identity, or locally through the Azure CLI (az login) or the AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_CLIENT_SECRET environment variables. The identity needs a role such as Storage Blob Data Contributor.

SAS Token

A shared access signature

Access is limited to the resources, permissions and expiry encoded in the signature, so it avoids handing out a long lived account key.

SAS token

A shared access signature is the approach Microsoft recommends for application level access to Azure Storage, because it can be scoped and given an expiry rather than granting unrestricted access to the account.

Generate one in the Azure portal under Shared access signature for the storage account, or with az storage account generate-sas, then paste the query string into the SAS Token field:

sv=2022-11-02&ss=b&srt=co&sp=rl&se=2026-12-31T00:00:00Z&sig=...

A leading ? is accepted and may be left in place. Do not paste a full URL — only the query string portion is expected.

The token is stored as a password in the connection metadata, which means it is encrypted at rest and masked in the UI, and it can be supplied through a variable so it does not have to be committed to a project at all.

A signature stops working once it expires, and Hop reports the resulting failure as an authentication error. Renew the token, or use Managed Identity where you want credentials that rotate for you.

Usage and testing

To test if the configuration works you can simply upload a small CSV file in an Azure Storage folder and then use File/Open in Hop GUI. Then you type in azure:// as a file location and hit enter (or click the refresh button). Browse to the CSV file you uploaded and open it. If all is configured correctly you should be able to see the content in the Hop GUI.