Skip to main content
Connect an Azure Blob container through a coding agent instead of assembling API requests by hand. The agent discovers the Azure resource coordinates, creates the project connector, guides any required Microsoft consent, grants container-scoped read access, tests the connection, and starts an immutable dataset sync.

​
What you provide

You normally need only:
  • The Azure Blob container URL, optionally including a blob prefix.
  • The Fastino project name or ID.
  • Whether the imported data is for training or evaluation.
The agent can derive the tenant, subscription, resource group, storage account, and container from your authenticated Azure CLI session. Connector and dataset names can default from the container name.

​
Before you start

  1. Connect your coding agent to your team’s Fastino MCP endpoint:
  2. Authenticate Azure CLI to the directory and subscription that own the storage account:
  3. Confirm your Azure identity can assign roles on the container. Azure roles such as Owner or User Access Administrator normally provide this.
Azure subscription roles and Microsoft Entra directory roles are separate. A subscription owner can grant Blob RBAC but might not be allowed to approve a new enterprise application in the directory.

​
Ask your agent

Give the agent the container URL rather than every Azure resource field:
The same prompt works in Cursor, Claude Code, or Codex when Fastino MCP and Azure CLI are available to that session.

​
What the agent does

1

Discover the source

The agent uses Azure CLI to resolve the storage account’s tenant, subscription, and resource group. Azure storage account names are globally unique, so the container URL is sufficient for discovery. The agent verifies these values from the storage account’s Azure metadata rather than your active CLI subscription. If it cannot verify them, it stops and tells you what is missing instead of guessing.
2

Create the project connector

Fastino stores the Azure resource coordinates, selected prefix, dataset name, and dataset purpose. It never asks for an account key, SAS token, client secret, or customer certificate.
3

Provision the Fastino identity

If Fastino’s enterprise application already exists in the storage tenant, no new consent is needed. Otherwise, someone in that tenant must open the Microsoft consent URL returned by the agent in a browser. The agent cannot approve this step on your behalf; tenant policy determines whether a user or an Entra administrator can approve it.
4

Grant least-privilege access

Fastino obtains its tenant-local service-principal object ID from its own Azure token. The agent then assigns Storage Blob Data Reader at the container scope. This avoids Microsoft Graph directory-read access and does not grant access to other containers.
5

Test and sync

The agent tests list-only access, queues an immutable snapshot, and polls the sync until it succeeds or returns an actionable error.

​
Sync results

A sync converts and validates the files under the selected prefix before it publishes datasets. A succeeded sync lists its datasets in the sync report.
  • If a file fails validation, the sync fails and publishes no dataset. The report lists the files to review. The agent relays those failures and asks before excluding files or changing the prefix.
  • If document conversion hits a rate limit, the report is marked partial (the listed datasets are usable, some files are missing) or transient (nothing new was published) and lists retryable_files. Ask the agent to sync again without retesting or changing the prefix.
  • A sync is optional when you delegate a fine-tune through Fastino MCP. After you approve the plan, the fine-tune agent can inspect and preprocess the raw files in the connected container.
When connecting the first container in an Azure tenant, someone in that tenant must open the returned setup.consent_url in a browser to create Fastino’s enterprise application. This is a one-time operation per tenant, not per container. If the application already exists, no new consent is needed.
  • A signed-in user can approve only if the tenant permits user consent to this application. Some tenants restrict consent to external applications without a verified publisher, so do not assume a regular user can approve it.
  • If user consent is blocked, give the returned setup.admin_consent_url to an Entra Cloud Application Administrator or Global Administrator for one-time approval.
  • Subscription ownership does not override the tenant’s Entra consent policy.
Consent does not grant access to any blobs. After it succeeds, the agent tests the connector to obtain Fastino’s tenant-local service-principal ID. A subscription owner or User Access Administrator then grants Storage Blob Data Reader on the chosen container. Each additional container needs its own container-scoped role assignment, but not another consent. Customers never need to edit Fastino’s app registration.

​
Security model

  • Fastino authenticates with its own certificate-backed, multi-tenant Entra application.
  • The certificate stays in Fastino’s secret store and is never shared with the customer or coding agent.
  • Customer storage credentials, SAS tokens, and account keys are not accepted.
  • Runtime access is read-only and scoped to the selected container.
  • Deleting a connector revokes future syncs but does not delete datasets already published to the Fastino project.

​
Troubleshooting

Azure RBAC changes can take several minutes to propagate. The agent should retry the test before creating another connector.