Azure Blob Storage connection strings

Azure endpoints use the az:// scheme. Choose the format that matches your authentication method.

DefaultAzureCredential (managed identity)

• az://container-name/path/ — relies on environment defaults (e.g. AZURE_STORAGE_ACCOUNT, managed identity, Azure CLI login). No secrets appear in the URI.

Account key authentication

• az://account-name:ACCOUNT_KEY@container-name/path/ — classic account key embedded alongside the account name.
• az://account-name:ACCOUNT_KEY@container-name — target the container root.

Connection string shortcut

• az://DefaultEndpointsProtocol=https;AccountName=acct;AccountKey=KEY;EndpointSuffix=core.windows.net@container/path/ — paste the entire storage connection string before @container.

SAS tokens

• az://sas:https://acct.blob.core.windows.net/container?sv=2023-08-03&sig=.../path/ — Shared Access Signature URL with optional folder suffix.

Common scenarios from the SAS guide:

• Container-level access:
  az://sas:https://acct.blob.core.windows.net/photos?sv=2022-11-02&ss=b&srt=co&sp=rwdlacupyx&se=2024-12-31T23:59:59Z&sig=...
• Folder target:
  az://sas:https://acct.blob.core.windows.net/photos?sv=2022-11-02&...&sig=.../uploads/
• Single blob:
  az://sas:https://acct.blob.core.windows.net/photos?sv=2022-11-02&...&sig=.../reports/daily.csv

Absolute vs relative blob paths

• az://account:key@container//archive/2024/ — keeps the leading slash in the blob name (/archive/2024/...).
• az://account:key@container/archive/2024/ — stores blobs under archive/2024/.

For long SAS URLs or connection strings, wrap the URI in quotes to prevent shell interpretation.

Putting it together

$ connect sync -r --delete \
    /srv/photos/ \
    az://mediaacct:S0meKeyValue@public-images/backups/

This sync mirrors /srv/photos/ into the backups/ prefix of the public-images container using account-key authentication.

Other examples:

• az://sas:https://acct.blob.core.windows.net/logs?sv=2022-11-02&...&sig=.../*.txt — copy every .txt file from a SAS-protected container.
• az://DefaultEndpointsProtocol=https;AccountName=acct;AccountKey=KEY;EndpointSuffix=core.windows.net@media/outgoing/ — use a full connection string when you already have it from the Azure portal.
• az://acct:KEY@container with --key ~/.ssh/id_ed25519 is valid when synchronizing between Azure and SFTP destinations in one command.