Solutions · Repository connectors

Search Azure Blob Storage for FOI and ATIP requests

Another system's export, a retired application's records, a custodian's bulk hand-over — browse the container as folders, search it by name and date, and capture files into the case as frozen copies with the blob path, ETag and SHA-256 on record. Built into AccessPoint: nothing to host.

Start Free Trial Request a Demo

More responsive records now arrive as exports than as originals. A line-of-business system is retired and its records are dumped to storage; a vendor hands over a case file as a folder of PDFs; a custodian with three thousand files puts them in a container instead of attaching them one by one. The access office then has to find the responsive ones, get them into the request without a detour through someone's laptop, and later show exactly which file it took and that it hasn't changed.

The Azure Blob Storage connector is built into the AccessPoint API. An administrator registers one container — or one virtual folder inside it, such as exports/2026/ — and grants the API's system-assigned managed identity the Storage Blob Data Reader role on the storage account. There is no service to install, no certificate, no Hybrid Connection and no secret to hold. Coordinators then browse the container as folders, search it by file name or path fragment with a modified-date filter, and capture files or collect whole folders. The connector only lists and downloads; it never writes to the account. The account doesn't have to be in the AccessPoint subscription: any Azure Blob Storage account the identity is granted the role on will do, as long as the App Service can reach its blob endpoint.

Each captured file becomes a document in the case with its container and blob path, the blob's ETag as its version, and a SHA-256 computed while it streams. When your export writes a sha256 metadata tag on each blob, AccessPoint compares the two and marks the hash Verified — a copy you can defend, not just a copy. The connector declares the Application identity mode: AccessPoint's own permission rule is the gate and there is no per-user trimming, so expose the folder the access office may collect from, not the whole account. Azure Storage's logs record the API's identity; who captured what, for which case and why is recorded in AccessPoint's Source details and audit ledger. Because it runs inside the AccessPoint API you already operate, the connector adds no Azure resource of its own; its reads are ordinary operations on the storage account, billed to the subscription that owns it.

Sound familiar?

Three moments every office that receives records as exports recognizes.

The export nobody can search

A retired permitting system's records were exported to a storage account last year. A request now names three applicants, and the only way to look is to ask IT to download the container and send a zip.

The detour through a laptop

Files come out of storage onto someone's desktop, get renamed, and are uploaded into the request one at a time. Afterwards, nobody can say which version was taken or where it sat.

The hash nobody checked

The export wrote a SHA-256 for every file. The request file never compares them, so the one thing that would prove each copy is intact goes unused.

What to look for when an FOI system reaches Azure Blob Storage

Whatever you use, these are the questions that separate a download link from a defensible collection.

Read-only access by role, not by key A managed identity with Storage Blob Data Reader means no account key or SAS token in a configuration file, and nothing that can write back to the export.
Scope by folder Expose the virtual folder the access office needs — exports/2026/ rather than every blob the organization has ever stored.
Hashes that are checked, not just stored If the export carries a SHA-256 per file, the capture should compare it, mark a match, and flag — not silently accept — a mismatch.
Versions that mean something The blob's ETag as the source version, so an unchanged file isn't captured twice on a case and an overwritten one is captured again.
Bulk collection with filters Collect a folder by modified date, name pattern, extension and size, in the background, with a count of what was captured and what was skipped.
Processed exactly like an upload PDF conversion, indexing, redaction scans, duplicate detection and malware scanning should run on a captured file just as they do on an upload.

How the Azure Blob Storage connector works

Configured in Settings, run by the AccessPoint API, read-only end to end.

Nothing to host

The connector runs inside the AccessPoint API. Register the storage account URL, the container and an optional folder prefix, grant one role, and run Test connection. There are no secret fields to manage.

Browse and search the container

Folders are built from the / in blob names. Search matches the file name, or a path fragment such as 2026/Bud, with a modified-date filter, over up to 5,000 blobs under the folder you search from.

Collect a whole export

Collect this folder takes every current blob under a prefix, filtered by the dialog's dates, name pattern, extensions and size, mirrored into case folders if you choose. Snapshots, soft-deleted blobs and old blob versions are never collected.

Verified hash from a sha256 tag

Azure's Content-MD5 is not a SHA-256 and isn't used. Have your export write a sha256 metadata tag and provenance reads Verified — or Mismatch, which is flagged and logged, never blocked.

Guard rails by design

Only Azure Storage blob endpoints are accepted — including Azure Government, Azure China and private-link forms — and AccessPoint's own documents account is refused, so a connector can never read the case store.

Open in source

Each captured document links back to the blob's URL, and the details flyout shows its content type. Opening the link needs the person's own access to the account; AccessPoint never grants it.

See it in AccessPoint

Real screens from the product, running in a Microsoft 365 tenant. Click any one to enlarge.

An Azure Blob container open in the Add records picker with Collect this folder on a folder's menu Click to enlarge
Browse the container. Folders in the container open in the request's Add records picker, ready to capture or collect.
An Azure Blob container connector registration with Test connection passed Click to enlarge
Test connection. The registration lists the container's capabilities and health, and checks each step.

Chain of custody

From blob to evidence, without a download in between

The AccessPoint API streams each blob into the case's own storage, computing its SHA-256 as it goes, then creates the document through the same pipeline as an upload. The document's Source details show the container and blob path, the ETag taken, the hash with its Verified, Mismatch or Not declared state, when the blob was last modified, who captured it and when, and the collection job it arrived through. An audit-ledger entry records the connector, the item, the version, the hash and the purpose, and the same provenance columns travel in the tenant's Settings export. A file over AccessPoint's upload limit is skipped as too large before a byte is read, and the notice after each capture explains every skip.

Stays in your tenant The storage account, the AccessPoint API and the case store are all in your own Azure; nothing passes through Realizer.
Attributed on your side Storage logs show the API's identity; AccessPoint records the person, the case and the purpose of every capture.
No per-connector fee Repository connectors are included in every AccessPoint plan.

From container to case

Set up once, then capture from any Documents workspace:

  1. In the Azure portal, grant the AccessPoint API's managed identity — its object id is on the App Service's Identity blade — the Storage Blob Data Reader role on the storage account.
  2. In AccessPoint, open Settings → Foundations → Repository connectors → Add connector, choose Azure Blob container, and enter the account URL, the container and an optional folder prefix. Choose who sees the tile — coordinators by default.
  3. Run Test connection. Its List children step is the first call that reaches Azure, so a pass proves the URL, the container and the role together.
  4. On a request, assessment, incident or complaint, open Add from…, choose the container, browse or search, and add the files — or use Collect this folder… for a whole export.
  5. Open Source details on a captured document for the path, ETag and hash state, and filter the workspace by Captured from to see everything taken from the container.

Go deeper

Repository connectors Every connector, how capture works, and the chain of custody behind it. Connectors in the docs Registering, testing and operating connectors, step by step. SQL database connector The other built-in for line-of-business systems — rows from a SQL view, captured as records. Network file share connector When the files are still on an on-premises share rather than exported to storage. Records & information managers Provenance and a defensible search across the systems you steward — including the retired ones. Security & data sovereignty Where captured records live, who can see them, and what never leaves your tenant.

Azure Blob Storage Connector Questions

Can AccessPoint search an Azure Blob Storage container for an FOI or ATIP request?
Yes. The Azure Blob Storage connector is built into AccessPoint: an administrator registers a container, or a folder prefix inside it, and coordinators browse it as folders, search it by file name or path fragment with a modified-date filter, and capture files or collect whole folders into any request, assessment, incident or complaint. Each capture is a frozen copy with the blob path, the ETag as its version, and a SHA-256.

Does the storage account have to be in the same subscription as AccessPoint?
No. Any Azure Blob Storage account will do, as long as the AccessPoint API's managed identity has been granted Storage Blob Data Reader on it and the App Service can reach the account's blob endpoint — if the account restricts network access, its rules must admit the App Service's outbound traffic. AccessPoint's own documents account is refused as a source.

What permissions does the Azure Blob connector need, and can it change files?
It needs one role: Storage Blob Data Reader for the AccessPoint API's system-assigned managed identity on the storage account. There is no account key, SAS token or other secret to store. The connector only lists blobs and downloads them; it never writes, so the account's own retention settings and locks are untouched. In AccessPoint, registering it takes the configuration permission, and by default only coordinators who manage documents see the tile.

Can it prove a file hasn't changed since it was exported?
Yes, when the export records it. If each blob carries a sha256 metadata tag holding the file's SHA-256, AccessPoint computes the hash while streaming the file into the case and compares the two: provenance reads Verified, or Mismatch — flagged and logged, never blocked. Without the tag, the capture is still a complete copy, provenance reads Not declared, and the computed digest is stored. Azure's Content-MD5 is not used.

Does data leave our tenant?
No. The connector runs inside the AccessPoint API in your own Azure subscription, reads the storage account with the API's managed identity, and streams each captured file into the case's own storage. The browser never touches the storage account, and nothing passes through Realizer. No information about the user is sent to Azure Storage; attribution is recorded on the AccessPoint side.

What does the Azure Blob Storage connector cost?
Nothing extra from Realizer: repository connectors are included in every AccessPoint plan, with no per-connector fee. The connector runs inside the AccessPoint API you already operate, so it adds no Azure resource of its own; its reads are ordinary operations on the storage account, billed to the subscription that owns it.

Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.

  • Under 500 employees$2,990/yr
  • 500–1,999 employees$7,990/yr
  • 2,000–9,999 employees$14,990/yr
  • 10,000+ employees$29,990/yr

See full pricing Build the business case

Turn the Export Into Evidence.

Try AccessPoint free for 30 days in your own Microsoft 365 tenant — repository connectors included, no per-connector fee.

Start Free Trial Request a Demo