This topic explains how to configure Microsoft Azure as a Cribl Lake Storage Location.

You can set an Azure Blob Storage container as the Storage Location for a Cribl Lake Dataset. This enables you to keep your data stored in Azure, but be able to search it in Cribl as a Dataset.

To connect Datasets, detach Storage Locations, and general BYOS limits, see Learn About Storage Locations.

Why Use an Azure Storage Location ​

By adding an Azure Storage Location to your Cribl Lake, you can:

• Keep log and security data in your own Azure storage account for compliance, but use Cribl for search and analytics over that data.
• Use Cribl Lake and Cribl Search to turn low-cost Azure Blob storage into a searchable archive.

Before You Begin ​

Complete these steps before configuring an Azure Storage Location in Cribl:

1. Log in to your Azure tenant and navigate to Object storage > Blob Storage.
2. Create a Storage Account and Blob container.
3. Go to Access Control (IAM), then:
   1. If you want customer-managed encryption keys, create an Azure Key Vault and key.
   2. Assign RBAC roles at the right scopes:
      • Storage Blob Data Contributor at the Container.
      • Storage Blob Data Owner at the Storage Account.
      • Key Vault Crypto User at the Key Vault.

Configure an Azure Storage Location ​

By following the recommended setup in this section, Cribl Lake will simplify creating a new Azure Blob Storage location for BYOS Lake Datasets.

Select a Storage Provider ​

1. Navigate to Lake > Storage Locations > New Storage Location.
2. Select Azure, then Next.

Configure Settings ​

Authenticate the Storage Account Access ​

After you configure the initial settings, you will authorize Cribl.Cloud in your Microsoft account, then generate an ARM template that you can download. Finally, launch the template in the Azure Data Storage console to create your infrastructure-as-code.

1. Select Authorize Cribl.Cloud to launch a new window and sign into your Microsoft account. This creates an enterprise application for your Cribl.Cloud organization in your Microsoft Azure account. For details about what admin consent grants and does not grant, see About Azure Authentication for Cribl Lake.
2. Once consent is confirmed, select Generate ARM Template, which downloads a JSON file containing the required IAM policies and roles. This will automatically provide Cribl Lake with access when you upload the JSON file to the Azure Storage account.

About the ARM Template ​

When you create an Azure Storage Location in Cribl Lake, the system generates a customized Azure Resource Manager (ARM) template for your environment. Deploying this template in Azure is a required step in the Cribl Lake Azure BYOS onboarding flow.

To learn about the ARM template, the resources it creates, storage account configuration, role assignments, inventory policy, and detailed steps on deploying it, see BYOS Azure ARM Template Reference.

Deploy the Custom Template in Microsoft Azure ​

To deploy the template in Azure:

1. In Microsoft Azure, navigate to Deploy a Custom Template.
2. Select Build your own template in the editor.
3. Select Load file and load the .json ARM template file you downloaded from Cribl.
4. Select the target Subscription and Resource Group.
5. Confirm the template loaded in Azure properly, then select Save.

To deploy the template in the command line:

Azure CLI

az deployment group create \
  --resource-group <your-resource-group> \
  --template-file CriblLakeByosAzureArmTemplate.json

PowerShell

New-AzResourceGroupDeployment `
  -ResourceGroupName <your-resource-group> `
  -TemplateFile CriblLakeByosAzureArmTemplate.json

Validate and Save the Azure Storage Location ​

Return to Cribl and move to Step 3: Confirm Template Deployment.

1. Check the box to tell Cribl that you’ve deployed the ARM template in Microsoft Azure.
2. Select Save.

Cribl will validate the configuration and connection to your Azure Storage account. At this step, Cribl will display any missing permissions if they are present.

When the connection is successful, you’ll see the Tenant ID in the list of Storage Locations.

When you attach a Dataset to this Storage Location, you can also select an Azure access tier (Inferred, Hot, Cool, Cold, or Archive) to control how Cribl Lake stores objects in your container. For details, see Storage Class for BYOS Datasets.

Supported Azure Regions ​

You can select any publicly available Azure region when you create an Azure Storage Location. There is no fixed subset of supported regions.

Select the region where your storage account already resides. Because the region of a storage is set when you create the account, and can’t be changed afterward, plan your region choice around your data residency, latency, and compliance requirements. To keep data in its region of origin, create a storage account, along with its Cribl Lake Storage Location, in each region where you need to land data.

When you save the Storage Location, Cribl validates that your storage account exists in the region you selected. If the storage account isn’t in that region, Cribl reports an error so you can correct the selection before finishing setup.

Existing Storage Locations in previously supported regions are unaffected.

FedRAMP Support ​

FedRAMP deployments of Cribl.Cloud can’t use Cribl Lake Azure storage locations.

Detach an Azure Storage Location ​

To detach this storage location:

1. Remove any Datasets with connected Collectors and Destinations.
2. Open the Storage Location and select Detach.
3. Select the checkbox and type DETACH in the text field.
4. Select Detach. Next, revoke Cribl access in Azure by following the steps in the Azure documentation: Delete an enterprise application.
5. In Cribl, confirm you revoked access in Azure.

Attach a Dataset via API ​

When you add a Dataset via API, you’ll reference the target Storage Location instead of a container name. You can set the Azure access tier with the storageClass field. Valid values are Inferred, Hot, Cool, Cold, and Archive. If you omit the field, the Dataset defaults to Inferred. Here is an example YAML configuration:

datasets:
  - id: my_dataset
    storageLocation: my-azure-byos-location
    retention: 30d
    format: json
    storageClass: Cool

Next Steps ​

Now that you’ve successfully created an Azure Storage Location, you can attach a Dataset to it. See Connect Datasets to Storage Locations for details.