15-Azure Blob SAS Token

Technical configuration

15-Azure Blob SAS Token

Objective

Enable secure Azure Blob SAS Token usage in D365 F&O without storing connection strings or storage keys directly in the system.

Prerequisite

  • Admin access to D365 F&O and Azure Portal
  • Azure Blob Storage Key (not the connection string)

Setup Sequence

  1. Create Azure AD Application
  2. Create Azure Key Vault
  3. Create Secret Key in Key Vault
  4. Configure Key Vault Parameters in D365 F&O
  5. Enable SAS Token in Self Service

Create Azure AD App

  1. Login to Microsoft Azure
  2. Click on Microsoft Entra ID
  3. Click on App Registration
  4. Click on New registration
    1. Define the name Azure Key Vault App
    2. Supported account types – Single Tenant only
  5. Click on Register
  6. Copy the Application Client Id and Save it in Notepad
  7. Under the Manage click on Certificate & Secrets
    1. Click on New client secret
    2. Define the Name and Expires – 730 days
    3. Click on Add
    4. Save the Value data from the Client Secret Screen
    5. Paste this Value in same Notepad

Create Azure Key Vault

  1. Login to Microsoft Azure
  2. Search Key vaults on Search resource bar
  3. Click on Create
  4. Define your Subscription
  5. For Resource Group Click on Create new
    • Define Name as AzureBlobKeyVault
    • Click on OK
  6. Define Key vault name as AzureBlobKeyVault
  7. Region as East US
  8. Pricing tier Standard
  9. Leave the remaining option as original
  10. Click on Next
  11. On Permission Model
    • Select Vault access policy
    • At the bottom of the page under Access Policies
      • Click on Create
      • Under Secret Permission
        • Select only Get & Llist
        • Click on Next
  • On the Principal
    • On Search bar type the Azure App name which you created on Step 1.4.a
      • Azure Key Vault App
      • Select the matching one
    • Click on Next
  • On Application
    • Click on Next
  • Click on Create
  • Now the screen looks like below image
  • Click on Review + create
  • Click on Create
  • Wait for few mins to complete the deployment
  • Once completed Click on Go to Resource
  • In Overview Copy the Vault URI and Paste it in the notepad

Create Secret Key

  • In Key Vault → Objects → Secrets
  • Click Generate/Import
  • Upload Options: Manual
  • Name: BlobKey
  • Secret Value: Azure Blob Storage Key
  • Enable: Yes
  • Click Create

Configure Key Vault in D365 F&O

  • Navigate to: System Admin → Setup → Key Vault Parameters
  • Click New
  • Name: AzureBlobKeyVault
  • Vault URI: from Step 2
  • Key Vault Client ID: from Step 1
  • Key Vault Client Secret: from Step 1
  • Under Secrets → Add
    • Name: BlobKey
    • Secret Value:vault://AzureBlobKeyVault/BlobKey
    • Secret Type: Manual
  • Click Save
  • Click Validate → Expect Validation Successful

Enable SAS Token in Self Service

  • Go to: Self‑Services → Setup → Application Parameter → Azure Blob Storage
  • Under Blob SAS:
    • Key Vault Name
    • Key Vault Secret
    • SAS URL Expiry (minutes): 1
    • Enable SAS Token URL: Yes
  • System prompt: “This feature will clear the connection string data in the system. Do you want to continue?”
    • Click Yes
  • Click Save