This topic explains how to configure Microsoft Azure as a Cribl Lake Storage Location.

You can set an Azure Blob Storage container as the Storage Location for a Cribl Lake Dataset. This enables you to keep your data stored in Azure, but be able to search it in Cribl as a Dataset.

To connect Datasets, detach Storage Locations, and general BYOS limits, see Learn About Storage Locations.

Why Use an Azure Storage Location ​

By adding an Azure Storage Location to your Cribl Lake, you can:

• Keep log and security data in your own Azure storage account for compliance, but use Cribl for search and analytics over that data.
• Use Cribl Lake and Cribl Search to turn low-cost Azure Blob storage into a searchable archive.

Before You Begin ​

Complete these steps before configuring an Azure Storage Location in Cribl:

1. Log in to your Azure tenant and navigate to Object storage > Blob Storage.
2. Create a Storage Account and Blob container.
3. Go to Access Control (IAM), then:
   1. If you want customer-managed encryption keys, create an Azure Key Vault and key.
   2. Assign RBAC roles at the right scopes:
      • Storage Blob Data Contributor at the Container.
      • Storage Blob Data Owner at the Storage Account.
      • Key Vault Crypto User at the Key Vault.

Configure an Azure Storage Location ​

By following the recommended setup in this section, Cribl Lake will simplify creating a new Azure Blob Storage location for BYOS Lake Datasets.

Select a Storage Provider ​

1. Navigate to Lake > Storage Locations > New Storage Location.
2. Select Azure, then Next.

Configure Settings ​

Authenticate the Storage Account Access ​

After you configure the initial settings, you will authorize Cribl.Cloud in your Microsoft account, then generate an ARM template that you can download. Finally, launch the template in the Azure Data Storage console to create your infrastructure-as-code.

1. Select Authorize Cribl.Cloud to launch a new window and sign into your Microsoft account. This creates an enterprise application for your Cribl.Cloud organization in your Microsoft Azure account.
2. Once consent is confirmed, select Generate ARM Template, which downloads a JSON file containing the required IAM policies and roles. This will automatically provide Cribl Lake with access when you upload the JSON file to the Azure Storage account.

About the ARM Template ​

When you create an Azure Storage Location in Cribl Lake, the system generates a customized Azure Resource Manager (ARM) template for your environment. Deploying this template in Azure is a required step in the Cribl Lake Azure BYOS onboarding flow.

To learn about the ARM template, the resources it creates, storage account configuration, role assignments, inventory policy, and detailed steps on deploying it, see BYOS Azure ARM Template Reference.

Deploy the Custom Template in Microsoft Azure ​

To deploy the template in Azure:

1. In Microsoft Azure, navigate to Deploy a Custom Template.
2. Select Build your own template in the editor.
3. Select Load file and load the .json ARM template file you downloaded from Cribl.
4. Select the target Subscription and Resource Group.
5. Confirm the template loaded in Azure properly, then select Save.

To deploy the template in the command line:

Azure CLI

az deployment group create \
  --resource-group <your-resource-group> \
  --template-file CriblLakeByosAzureArmTemplate.json

PowerShell

New-AzResourceGroupDeployment `
  -ResourceGroupName <your-resource-group> `
  -TemplateFile CriblLakeByosAzureArmTemplate.json

Validate and Save the Azure Storage Location ​

Return to Cribl and move to Step 3: Confirm Template Deployment.

1. Check the box to tell Cribl that you’ve deployed the ARM template in Microsoft Azure.
2. Select Save.

Cribl will validate the configuration and connection to your Azure Storage account. At this step, Cribl will display any missing permissions if they are present.

When the connection is successful, you’ll see the Tenant ID in the list of Storage Locations.

Supported Azure Regions ​

Each Azure Storage Location can map to a bucket in one of the following Azure regions:

• Japan East (japaneast)
• Southeast Asia (southeastasia)
• Australia East (australiaeast)
• Canada Central (canadacentral)
• Germany West Central (germanywestcentral)
• Switzerland North (switzerlandnorth)
• North Europe (northeurope)
• UK South (uksouth)
• France Central (francecentral)
• Brazil South (brazilsouth)
• East US (eastus)
• East US 2 (eastus2)
• West US 2 (westus2)

FedRAMP Support ​

FedRAMP deployments of Cribl.Cloud can’t use Cribl Lake Azure storage locations.

Detach an Azure Storage Location ​

To detach this storage location:

1. Remove any Datasets with connected Collectors and Destinations.
2. Open the Storage Location and select Detach.
3. Select the checkbox and type DETACH in the text field.
4. Select Detach. Next, revoke Cribl access in Azure by following the steps in the Azure documentation: Delete an enterprise application.
5. In Cribl, confirm you revoked access in Azure.

Next Steps ​

Now that you’ve successfully created an Azure Storage Location, you can attach a Dataset to it. See Connect Datasets to Storage Locations for details.