Azure Blob Storage
This document outlines the Azure Blob Storage configuration requirements needed for Conversation Intelligence (CI) to connect to your storage environment. Please review each section and gather the listed information.
The process retrieves audio recordings and associated metadata (CSV) from your Azure Blob Storage container on a scheduled basis. Providing the correct credentials and configuration upfront ensures a smooth setup.
Authentication & Access
Connection String Options
Capacity requires one of the following to authenticate with your Azure Blob Storage container. Only one is needed:
| Credential Type | Notes |
|---|---|
| SAS Connection String (Recommended) | Scoped to a specific container; supports expiry, IP restrictions, and fine-grained permissions. Preferred for least-privilege access. |
| Account-Level Connection String | Grants full access to the storage account. Use only if SAS is not feasible in your environment. |
A SAS Connection String is strongly recommended because it can be scoped to a single container with fine-grained permissions, reducing the blast radius of any credential exposure. Account-Level Connection Strings grant full storage account access and should only be used where a SAS approach is not viable.
SAS Token — Format & Permissions
When generating a SAS token via the Generate SAS option on a container in the Azure Portal, the token is returned as a query string. Below is an example of the format you will see:
sp=racwdl&st=2026-01-05T15:51:30Z&se=2026-01-26T00:06:30Z&spr=https&sv=2024-11-04&sr=c&sig=KfyDuPgf%2F%2FXXXXXXXXXXXXXXXXXXA%3D
Token Parameters
The key parameters in the SAS token are:
| Parameter | Example Value | Description |
|---|---|---|
| sp | sp=rl | Permissions granted (see below) |
| st | st=2026-01-05T15:51:30Z | Token valid from (start date/time, UTC) |
| se | se=2026-01-26T00:06:30Z | Token expires at (end date/time, UTC) |
| spr | spr=https | Allowed protocol — HTTPS only |
| sv | sv=2024-11-04 | Storage service version |
| sr | sr=c | Resource scope — "c" means container-level |
| sig | sig=... | Cryptographic signature (do not modify) |
Permissions (sp parameter)
The sp parameter controls what operations are permitted. Each letter maps to a specific permission:
| Flag | Permission | Required by Capacity? |
|---|---|---|
| r | Read — read blob content | Yes (minimum required) |
| l | List — list blobs in the container | Yes (minimum required) |
| d | Delete — delete blobs after ingestion | Required if Capacity manages file cleanup |
| a | Add — append to existing blobs | Not required |
| c | Create — create new blobs | Not required |
| w | Write — overwrite blob content | Not required |
At minimum, the token must include sp=rl (Read + List). If Capacity is responsible for cleaning up processed files from the container, sp=rld (Read + List + Delete) is required instead.
Do not grant permissions beyond what is needed. Avoid including Write (w) or Create (c) unless explicitly agreed with the Capacity team. Overly permissive tokens increase risk if credentials are inadvertently exposed.
The storage account name (StorageAccount) is found in the Azure Portal and must be shared alongside the SAS token so Capacity can construct the correct endpoint URL.
Token Expiry & Renewal
SAS tokens have a mandatory expiry date set at the time of creation. You must establish an internal process to:
- Monitor the token expiry date and generate a replacement token before it lapses.
- Send the updated connection string to the Capacity team in advance of the expiry to avoid any interruption to the ingestion pipeline.
If a SAS token expires before it is renewed, Capacity will lose access to the container immediately, causing missed recordings and gaps in your CI data. Capacity recommends setting an internal reminder at least two weeks before the token expiry date.
Account-Level Connection Strings do not expire by default, but should be rotated periodically in line with your organisation's key management policy. Any rotation must be communicated to Capacity before the old key is invalidated.
Container Configuration
Container Name
Provide the exact name of the Azure Blob Storage container that holds (or will hold) your recordings. The container name is case-sensitive. Example:
my-contact-centre-recordings
If you are creating a new container specifically for this integration, ensure it is set to Private access (not Blob or Container level public access).
Folder Structure
Capacity recommends the following date-partitioned folder structure within your container. This allows the ingestor to retrieve files efficiently by date range:
/yyyy/mm/dd/audio/ /yyyy/mm/dd/csv/
Within each daily folder, create two sub-folders:
- audio/ — place call recording files here (e.g. .wav, .mp3)
- csv/ — place the corresponding metadata file(s) here
Using a non-standard folder structure is possible but will require additional configuration. If your existing pipeline already writes files to a different path format, let the Capacity team know and include a sample path so this can be accommodated during setup.
Blob Retention
Retention of data within the Azure Blob Storage container is your responsibility. Configure a lifecycle management policy in Azure that aligns with your data governance and compliance obligations. Capacity does not manage or modify blob retention settings.
To set a retention policy in the Azure Portal, navigate to:
Storage Account → Data management → Lifecycle management
Deleting files from the container before they have been successfully ingested by Capacity will result in those recordings being permanently missed. Ensure your retention window is long enough to accommodate any re-processing scenarios — Capacity recommends a minimum of 30 days.
What to Share with Capacity
Complete the table below and share it with your Capacity contact. All fields are required before configuration and testing can begin.
| Item | Value / Confirmed |
|---|---|
| Connection string type selected | ☐ SAS ☐ Account-Level |
| Storage account name | |
| Connection string / SAS token provided | |
| SAS token permissions (sp= value) | ☐ sp=rl ☐ sp=rld |
| SAS token expiry date | |
| Internal renewal process in place | ☐ Yes ☐ In progress |
| Container name | |
| Blob retention period configured | |
| Folder structure confirmed | ☐ Standard (yyyy/mm/dd) ☐ Custom (specify) |
Once the above information has been shared, the Capacity team will carry out integration testing and confirm successful connectivity. You will be notified when the ingestor is live and processing recordings.