Connection Strings & Keys in Azure Blob Storage

Overview

Connection strings and account keys are used to authenticate and access Azure Storage resources.

What Are Connection Strings?

A connection string contains all the information needed to connect to a storage account:

DefaultEndpointsProtocol=https;
AccountName=mystorage001;
AccountKey=your-account-key-here;
EndpointSuffix=core.windows.net

Finding Your Connection String

  1. Go to Storage Account in Azure Portal
  2. Navigate to Security + networking → Access keys
  3. Copy either "Connection string" (key1 or key2)

Account Keys

Each storage account has two account keys (key1 and key key2):

  • Both keys provide full access to the entire storage account
  • Keys are typically 88 characters long
  • They never expire

Best Practice: Use Key Rotation

# Update connection string to use key2
# Then regenerate key1
az storage account keys renew \
  --resource-group myrg \
  --account-name mystorage001 \
  --key key1

Problems with Account Keys

IssueWhy It's a Problem
Hard to rotateNeed to update all applications
Too much accessKeys grant full admin access
Security riskIf key leaks, entire storage compromised
No audit trailCan't track who accessed what

Better Alternatives

1. Use Managed Identity (Recommended)

// Instead of connection string, use:
var blobServiceClient = new BlobServiceClient(
    new Uri("https://mystorage001.blob.core.windows.net"),
    new DefaultAzureCredential()
);

2. Use SAS Tokens (For limited access)

  • Time-limited access
  • Can restrict to specific container/blob
  • Can restrict permissions (read, write, etc.)

Security Recommendations

  1. Never commit keys to git - Use environment variables
  2. Use Managed Identity in production
  3. Rotate keys regularly - At least every 90 days
  4. Use SAS tokens for external sharing
  5. Enable Azure Defender for threat detection

Next Steps

Azure Integration Hub - Beginner Level