> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use https://docs.fastino.ai/llms.txt to discover and navigate pages. Use https://docs.fastino.ai/llms-full.txt when you need the complete documentation corpus. Use https://docs.fastino.ai/openapi.json as the source of truth for customer-facing routes. For GLiDE decision inference, call POST https://api.fastino.ai/v1/systemone with model fastino/GLiDE. Create managed config jobs with POST /v1/training/jobs using base_model. For custom training loops, native JSON clients use the public operations under /v1/training/jobs and /v1/training/usage. Existing Tinker clients use tinker==0.32.0 with TINKER_BASE_URL=https://api.fastino.ai/v1/training/compat/tinker and TINKER_CREDENTIAL_CMD. Compatibility child routes are private and absent from OpenAPI. Auto Train is private access and has no public route; direct interested users to sales@fastino.ai. Do not infer undocumented routes. Read API keys from FASTINO_API_KEY and never embed credentials in code, logs, or reports.

# Connect Azure Blob data with a coding agent

> Ask Cursor, Claude Code, or Codex to connect an Azure Blob container to a Fastino project with read-only access.

Connect an Azure Blob container through a coding agent instead of assembling API
requests by hand. The agent discovers the Azure resource coordinates, creates the
project connector, guides any required Microsoft consent, grants container-scoped
read access, tests the connection, and starts an immutable dataset sync.

## What you provide

You normally need only:

* The Azure Blob container URL, optionally including a blob prefix.
* The Fastino project name or ID.
* Whether the imported data is for `training` or `evaluation`.

The agent can derive the tenant, subscription, resource group, storage account,
and container from your authenticated Azure CLI session. Connector and dataset
names can default from the container name.

## Before you start

1. Connect your coding agent to your team's Fastino MCP endpoint:

   ```text theme={null}
   https://api.fastino.ai/v1/teams/YOUR_TEAM_ID/mcp
   ```

2. Authenticate Azure CLI to the directory and subscription that own the storage
   account:

   ```bash theme={null}
   az login
   az account show
   ```

3. Confirm your Azure identity can assign roles on the container. Azure roles
   such as **Owner** or **User Access Administrator** normally provide this.

> [!NOTE]
>
> Azure subscription roles and Microsoft Entra directory roles are separate. A
> subscription owner can grant Blob RBAC but might not be allowed to approve a
> new enterprise application in the directory.

## Ask your agent

Give the agent the container URL rather than every Azure resource field:

```text theme={null}
Connect https://customerdata.blob.core.windows.net/training/incoming/
to my Fastino project "support-classifier" as training data.

Use my current Azure CLI session. Grant only Storage Blob Data Reader on this
container, test the connector, sync it, wait until the sync finishes, and report
the resulting datasets. Do not start training.
```

The same prompt works in Cursor, Claude Code, or Codex when Fastino MCP and Azure
CLI are available to that session.

## What the agent does

**1. Discover the source**

The agent uses Azure CLI to resolve the storage account's tenant,
subscription, and resource group. Azure storage account names are globally
unique, so the container URL is sufficient for discovery. The agent verifies
these values from the storage account's Azure metadata rather than your
active CLI subscription. If it cannot verify them, it stops and tells you
what is missing instead of guessing.

**2. Create the project connector**

Fastino stores the Azure resource coordinates, selected prefix, dataset name,
and dataset purpose. It never asks for an account key, SAS token, client
secret, or customer certificate.

**3. Provision the Fastino identity**

If Fastino's enterprise application already exists in the storage tenant,
no new consent is needed. Otherwise, someone in that tenant must open the
Microsoft consent URL returned by the agent in a browser. The agent cannot
approve this step on your behalf; tenant policy determines whether a user
or an Entra administrator can approve it.

**4. Grant least-privilege access**

Fastino obtains its tenant-local service-principal object ID from its own
Azure token. The agent then assigns **Storage Blob Data Reader** at the
container scope. This avoids Microsoft Graph directory-read access and does
not grant access to other containers.

**5. Test and sync**

The agent tests list-only access, queues an immutable snapshot, and polls the
sync until it succeeds or returns an actionable error.

## Sync results

A sync converts and validates the files under the selected prefix before it
publishes datasets. A succeeded sync lists its datasets in the sync report.

* If a file fails validation, the sync fails and publishes no dataset. The report
  lists the files to review. The agent relays those failures and asks before
  excluding files or changing the prefix.
* If document conversion hits a rate limit, the report is marked `partial` (the
  listed datasets are usable, some files are missing) or `transient` (nothing new
  was published) and lists `retryable_files`. Ask the agent to sync again without
  retesting or changing the prefix.
* A sync is optional when you delegate a fine-tune through Fastino MCP. After you
  approve the plan, the fine-tune agent can inspect and preprocess the raw files
  in the connected container.

## Microsoft consent

When connecting the first container in an Azure tenant, someone in that tenant
must open the returned `setup.consent_url` in a browser to create Fastino's
enterprise application. This is a one-time operation per tenant, not per
container. If the application already exists, no new consent is needed.

* A signed-in user can approve only if the tenant permits user consent to this
  application. Some tenants restrict consent to external applications without
  a verified publisher, so do not assume a regular user can approve it.
* If user consent is blocked, give the returned `setup.admin_consent_url` to an
  Entra **Cloud Application Administrator** or **Global Administrator** for
  one-time approval.
* Subscription ownership does not override the tenant's Entra consent policy.

Consent does not grant access to any blobs. After it succeeds, the agent tests
the connector to obtain Fastino's tenant-local service-principal ID. A
subscription owner or User Access Administrator then grants **Storage Blob Data
Reader** on the chosen container. Each additional container needs its own
container-scoped role assignment, but not another consent. Customers never need
to edit Fastino's app registration.

## Security model

* Fastino authenticates with its own certificate-backed, multi-tenant Entra
  application.
* The certificate stays in Fastino's secret store and is never shared with the
  customer or coding agent.
* Customer storage credentials, SAS tokens, and account keys are not accepted.
* Runtime access is read-only and scoped to the selected container.
* Deleting a connector revokes future syncs but does not delete datasets already
  published to the Fastino project.

## Troubleshooting

| Status or Microsoft error | Meaning | Action |
| - | - | - |
| `consent_missing` | Fastino's enterprise application does not exist in the Azure tenant | Open the returned consent URL; use a tenant administrator only if policy requires one |
| `AADSTS1003031` | Fastino's Entra app registration is misconfigured; this may appear during Microsoft consent or as `provider_error_code` with `consent_missing` | Contact Fastino support; do not change your tenant's app registration or Blob RBAC to work around it |
| `role_missing` | Consent succeeded, but Blob RBAC is absent | Run the returned container-scoped role assignment command, then retest |
| `container_missing` | The storage account, container, tenant, or subscription does not match | Ask the agent to rediscover the source from the container URL |
| `unavailable` | Azure or Fastino could not complete the test | Retry the test; contact Fastino support if it keeps failing |

Azure RBAC changes can take several minutes to propagate. The agent should retry
the test before creating another connector.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.