# Blob Reader

> Download a blob (CSV, JSON, or any file) from Azure Blob Storage using the caller's (agent's) managed identity via AAD — no account key or SAS. Use when an agent needs to read input data a user placed in their own blob container, including from inside a managed harness or sandbox where DefaultAzureCredential resolves to the agent identity. Requires the identity to hold the 'Storage Blob Data Reader' role on the container or account.

- Skill: `azure-ai-foundry/blob-reader` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add azure-ai-foundry/blob-reader`
- Raw SKILL.md: https://api.skillmd.com/api/skills/azure-ai-foundry/blob-reader/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: azure-ai-foundry (https://skillmd.com/u/azure-ai-foundry)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/azure-ai-foundry/blob-reader

---


# Blob Reader

## Overview

Download a blob from Azure Blob Storage authenticated with an **AAD bearer token** (the
caller's identity), not an account key or SAS. The bundled `scripts/read_blob.py` is
stdlib-only (no pip installs) so it runs on a bare Python image such as a harness sandbox.
In a managed harness the **agent's managed identity** is used automatically via
`DefaultAzureCredential`.

## Prerequisites

- **`HOLDINGS_BLOB_URL`** (or `--url`) — the full blob URL,
  `https://<account>.blob.core.windows.net/<container>/<blob>`.
- **A token** — resolved automatically: `--token` / `STORAGE_TOKEN` env, then
  `DefaultAzureCredential`, then `az account get-access-token`. Scope is
  `https://storage.azure.com/.default`.
- **RBAC**: the identity must have **Storage Blob Data Reader** on the container or account
  (role id `2a2b9908-6ea1-4ae2-8e65-a410df84e7d1`). A 401/403 means the role is missing.

## Usage

```bash
export HOLDINGS_BLOB_URL="https://<account>.blob.core.windows.net/<container>/holdings.csv"

python scripts/read_blob.py --out ./holdings.csv   # or omit --out to stream to stdout
```

## Key rules

- **401/403 = missing role**, not transient — report it plainly and stop; do not retry.
- **404 = wrong URL** (container/blob path). The URL is the container + blob path, not a SAS.
- Reads only; this skill never writes or deletes. Data-plane role, not control-plane.