Azure Blob Storage

Three steps connect a flow to a container in Azure Blob Storage:

• Azure Blob: List files – find the files in a folder, optionally only those with certain index tags.
• Azure Blob: Get file – download one file into the AutoFlow document library.
• Azure Blob: Upload file – write a document, a BLOB or Media field, or text to a file, with index tags.

Typical use cases:

• Archive every posted sales invoice as a PDF in invoices/2026/, tagged with the customer number.
• Pick up the order files a partner drops into inbound/ and process each one in a For Each Loop.
• Download a file named in an incoming webhook and attach it to an email.

Before you start: the connection

All three steps start with the same three fields.

Credential

An AutoFlow Credential that signs in to Azure. Two kinds are accepted:

• OAuth 2.0 client credentials – an app registration in Microsoft Entra ID. This is the recommended way: nothing expires unnoticed, and access can be limited to one container. See Set up an Entra app below.
• Azure Storage SAS token – a shared access signature created in the Azure portal. Quicker to set up, but it expires on the date you choose and has to be replaced then.

Other credential types are refused with an error. If the credential has Base URLs, they must allow https://<storage account>.blob.core.windows.net/<container> – otherwise the step stops before anything is sent.

Storage account

The name of the storage account – contosodocs for https://contosodocs.blob.core.windows.net. Lowercase letters and digits, 3 to 24 characters.

Container

The name of the blob container. Lowercase letters, digits and hyphens, 3 to 63 characters.

Account and container may be SmartFields, e.g. from a setup record, so one flow can serve several environments. A SmartField value is checked when the step runs.

List files

Path

Lists the files whose path starts with this text. invoices/2026/ lists everything in that folder and its sub-folders; invoices/2026/INV-10 lists only the files whose name starts with INV-10. Leave it empty to list the whole container.

Only this folder level

Lists only the files directly inside the folder given in Path and skips its sub-folders. The path is then always read as a folder: invoices and invoices/ mean the same.

Index tag filter

Lists only the files whose index tags match. Each row is one condition – a tag, an operator (=, >, >=, <, <=) and a value – and all rows must match. Values are compared as text, so write dates and numbers so that they sort correctly (2026-09-29, 000125).

With a tag filter, Azure searches the whole storage account by tag and the step then keeps the files in the container under Path. Files found this way come back with their name, path and tags only – no size, content type or dates. Use Get file when you need those.

Maximum number of files

The step stops after this many files. Default is 500, maximum 5000.

Include index tags

Returns the index tags of each file. Reading tags needs more rights than reading files – see Permissions. Switch it off if the Entra app or SAS token is not allowed to read tags.

Error on empty result

Stops the flow with an error when no file is found. Off by default: the step then returns count = 0.

Outputs

Output	Content
count	Number of files found.
results	The files, one entry each – use it in a For Each Loop. Each entry has the fields Name (file name), Path (full path in the container), Parent Directory, Size (bytes), Content Type, Created At, Last Modified, ETag, Tags and Metadata (both as JSON, e.g. {"Status":"open"}).

In a For Each Loop over results, pass the entry's Path to a Get file step to download each file.

Get file

File path

The path of the file inside the container, e.g. invoices/2026/INV-1001.pdf.

Include index tags

Returns the file's index tags in the tags output. See Permissions.

Error if the file is missing

On by default: the flow stops when the file does not exist. Switch it off to continue instead – the found output is then false, and a Decision step can take a different path. Other problems, such as missing permissions, always stop the flow.

Outputs

Output	Content
found	true, or false when the file is missing and Error if the file is missing is off.
Document	The downloaded file in the AutoFlow document library. Use it like the document of a Create PDF Document step – as an email attachment in Send Email, as the body of an HTTP Request, or as the Content of an Upload file step.
name, path	File name and full path.
contentType, size	MIME type and size in bytes.
lastModified, etag	When the file was last changed in Azure, and its version tag.
tags, metadata	Index tags and metadata as JSON, e.g. {"Status":"open"}.

Upload file

File path

Where the file is written, e.g. invoices/{{Sales Invoice Header.No.}}.pdf. Folders do not need to exist – Azure creates them with the file.

Content

What is uploaded:

• a document from an earlier step, e.g. the Document of a Create PDF Document or Get file step,
• a BLOB or Media field of a record, e.g. an item picture,
• or text – anything else, with SmartFields resolved first, is uploaded as UTF-8 text.

Documents and fields are only uploaded as files when Content holds exactly one SmartField and nothing else. Text around it turns the whole content into text.

Content type

The MIME type stored with the file, e.g. application/pdf. Leave it empty to take the document's content type, or – for fields and text – the type that matches the file extension (.pdf, .xml, .json, .txt, .csv, .png, .jpg, …).

Overwrite existing file

On by default: an existing file with the same path is replaced. Switch it off to stop the flow with an error instead.

Index tags

Up to 10 index tags written with the file. Values may be SmartFields.

Outputs

Output	Content
path, name	Full path and file name of the uploaded file.
url	The file's address, e.g. https://contosodocs.blob.core.windows.net/documents/invoices/INV-1001.pdf. It is not a download link – opening it needs the same rights as the flow.
size, contentType	Size in bytes and the content type stored with the file.

Index tags

Index tags are name/value pairs stored with a file that Azure can search. They are the way to find files by customer, status or year without walking through folders – the Index tag filter of List files searches them.

Azure's rules for tags:

• at most 10 tags per file,
• names 1 to 128 characters, values up to 256 characters,
• letters, digits, spaces and + - . / : = _ only – no umlauts or other special characters.

Metadata, which Azure also stores with a file, is returned by List files and Get file but cannot be searched.

Set up an Entra app

1. In the Azure portal, open Microsoft Entra ID > App registrations and register a new app (single tenant). Note the Application (client) ID and the Directory (tenant) ID.
2. Under Certificates & secrets, create a client secret and copy its value.
3. Open the storage account (or only the container) and go to Access control (IAM) > Add role assignment. Assign a role to the app – see Permissions.
4. In Business Central, create an AutoFlow Credential with the authentication type OAuth 2.0 client credentials:
   • OAuth token URL: https://login.microsoftonline.com/<tenant ID>/oauth2/v2.0/token
   • OAuth client ID: the application ID
   • Client secret: the secret value
   • OAuth scope: https://storage.azure.com/.default

A credential you already use for Microsoft Graph cannot be used for Blob Storage, even if it is the same app: an access token is only valid for the service named in the scope. Create a second credential for the same app with the storage scope. The step shows a warning when the selected credential has a different scope.

Role assignments can take a few minutes to take effect.

Permissions

To …	Entra app role	SAS permission
list files	Storage Blob Data Reader	List (l)
download a file	Storage Blob Data Reader	Read (r)
upload a file	Storage Blob Data Contributor	Write (w) and Create (c)
read or write index tags	Storage Blob Data Owner	Tags (t)
filter by index tags	Storage Blob Data Owner, on the storage account	Filter (f), in an account SAS

A role assigned on the storage account covers all its containers; a role assigned on a container covers only that one. Filtering by index tags searches the whole storage account, so the role for it must be assigned on the account.

When Azure refuses a request, the error message names the Azure error code and the rights needed.

Notes

• Files are transferred in one piece. Business Central limits the size of a single transfer – plan for files up to about 100 MB.
• The results of List files are kept in the Azure Blob Entries list only as long as the flow needs them: they are removed when the execution completes successfully or is deleted. After a failed execution they stay, so Restart Execution can continue with them; deleting the execution removes them.
• Every Get file run adds a document to the document library.