Set up Azure Files
Connect an Azure Files storage account to Glean using the Microsoft Entra application configured for the parent Microsoft 365 connector.
Prerequisites
Prepare the parent Microsoft 365 connection and Azure access before you connect a storage account.
Prepare the Microsoft 365 connection
Complete the parent Microsoft 365 setup in Glean, including its administrator requirements, application and tenant IDs, certificate, and private key. See Choose your Microsoft 365 setup.
Azure Files reuses that application's certificate-backed credentials. You don't register a separate application for Azure Files. A parent connection configured only with a client secret isn't sufficient.
Confirm that the parent connection can crawl the relevant users and group memberships. Azure Files also needs the Microsoft 365 identity information used to map file-system security identifiers to users and groups. Source access alone doesn't confirm that a user's permissions can be mapped in Glean.
Arrange Azure role assignments
Ask an Azure administrator who can assign roles at both the subscription and storage account scopes to grant these roles to the same Microsoft Entra application used by the parent Microsoft 365 connection:
| Role | Assignment scope | Purpose |
|---|---|---|
| Reader | Subscription containing the storage account | Read resource-provider metadata, storage account and share information, and Azure permission metadata |
| Storage File Data Privileged Reader | Storage account to connect | Read file content, directories, and file-system permissions through the Azure Files API |
Assign Reader at subscription scope, not at the resource group alone. Reader doesn't grant file-content access, so both roles are needed. Glean doesn't require Storage File Data Privileged Contributor or other write access for this connector.
These roles apply to the connector application. Don't assign them to all end users as a way to make search results visible. See Azure Files permissions for the distinction.
Collect the storage account details
In the Azure portal, open the storage account's Overview page and record:
- Subscription ID
- Resource group
- Storage account name
Use the values for the same storage account and subscription where you assign the application roles. Each Azure Files connector instance connects to one storage account.
Review the source environment
Glean needs to reach Azure Resource Manager and the storage account's Azure Files endpoint. If your account uses firewall restrictions, private endpoints, or a nonstandard Azure environment, confirm the supported connection path with your Glean account team before setup. Don't weaken storage network restrictions to troubleshoot the connector.
Review advanced file-system permissions before connecting the shares. If your configuration uses conditional or object-specific access-control entries, or conditional Azure role assignments, confirm compatibility with Glean before relying on those rules for search access.
Grant access to Azure Resource Manager
Assign the Reader role to the Microsoft Entra application used by the parent Microsoft 365 connector. Assign it at the subscription that contains the storage account, not at the resource group alone.
- Sign in to the Azure portal.
- Open the subscription that contains the storage account and select Access control (IAM).
- Click Add → Add role assignment and choose Reader.
- Under Assign access to, select User, group, or service principal. Select the Microsoft Entra application used by the parent Microsoft 365 connector and complete the role assignment.
The Reader role lets Glean discover the storage account and file shares, and read role assignments, deny assignments, and role definitions. It doesn't grant access to file contents. See Reader.
Grant read access to file data
Assign Storage File Data Privileged Reader to the same application at the storage account. Glean doesn't require write access to Azure Files.
- In the Azure portal, open the storage account and select Access control (IAM).
- Click Add → Add role assignment and choose Storage File Data Privileged Reader.
- Assign the role to the same Microsoft Entra application used by the parent Microsoft 365 connector.
This role lets Glean read files, directories, and New Technology File System (NTFS) permissions through the Azure Files API. Glean uses the retrieved permissions to enforce access in search results. See Storage File Data Privileged Reader.
Azure role assignments can take several minutes to take effect.
Enter the storage account details
- In Glean's Admin console, open the saved parent Microsoft 365 connection and select Azure Files from its child connector list.
- Enter a Name for the Azure Files connection.
- On the storage account's Overview page in the Azure portal, copy the Subscription ID, Resource group, and Storage account name. Enter these values in Glean's Subscription ID, Resource group name, and Storage account name fields.
- Click Save.
Select content to crawl
In the Azure Files connector's Manage data tab, use the following optional controls to select content. Save the changes after editing the fields.
| Field | What to enter |
|---|---|
| Included file shares (comma separated) | Exact file-share names, separated by commas. Leave this empty to select all file shares returned for the configured storage account |
| Excluded paths (comma separated) | Path patterns to skip, separated by commas. Patterns are matched against share-relative and share-prefixed paths. For example, archive/** excludes an archive subtree relative to a share |
These controls select content for crawling. They aren't a substitute for source permissions and don't establish that previously indexed items have already been removed after a configuration change.
Verify the connection
Setup validation checks the required configuration and whether the application can list file shares through Azure Resource Manager. It doesn't test file-content downloads, file-system permission retrieval, or individual users' search access.
After saving the connection:
- Review the connector's crawl status and any reported errors. See Monitor connectors sync progress.
- After content and permission processing complete, search for representative files from the intended shares.
- Test with a user who has access and a user who doesn't. See Validate access before broader use.
Don't treat a successful save as confirmation that the connection is ready for broader use. If content or access doesn't match expectations, use Troubleshooting or contact Glean Support.