Storage with Azure

This guide describes how to create a storage account in Microsoft Azure. You can use a storage account with Axinom Encoding as an input and/or output storage.

To create an Azure storage account:

On the Azure Portal, click the three bars in the top left corner to open the menu. From the menu, click Create a resource.

Start creating a resource
On the next page, click Storage. A list of services appears to the right. From this list, pick Storage account and click Create.

Start creating a storage account
You will be redirected to a Create a storage account page. Select your subscription and a resource group. You should give a unique storage account name and select Azure Blob Storage or Azure Data Lake Storage Gen 2 as primary service. Then you can create your Storage account.

Create storage account
Next click Create
After the reviewing and the creating a storage account, you can find the created storage account from the Storage account list.
Create a container in your storage account (in the left pane, "containers" under "Data storage"). You may want to create separate containers for video input and output when encoding.

Create Container for Storage account
The SAS Token that allows to list and upload (but not read/download) files must be generated with specific permissions. The management token is responsible for two operations:
- Listing folders
- Uploading a file to the storage
  
  To allow these operations, navigate to your Storage account in the Azure Portal. From there, go to Security + networking and Shared access signature. Then you need to select the necessary permissions. The following permissions must be set:
- Allowed services - Blob
- Allowed resource types - Container and Object
- Allowed permissions - Write and List
- The End date has to be at some point in the future
  
  SAS token setup example
Once you generate the SAS Token, you should store the created "Connection String,” "SAS Token,” and "Blob Service SAS URL.” Otherwise, these credentials will not be visible once you go to another page.

note
The SAS token returned by the portal does not include the delimiter character ('?'). Therefore, when using this token, remember to add the delimiter character before it.
To retrieve the Access keys for a storage account, go to the Azure Portal and your Storage Account. Navigate to Security + networking → Access keys, click Show, and get a connection string, similar to one below:
```
DefaultEndpointsProtocol=https;AccountName=examplestoragename;AccountKey=pCFqwDE0AwVa3LS4Fg3ypAqHbCFTidv6kbtDbDfGWb2wwRaL7F7kccze3OAVAHLSZn+QwId5SaCMy1vUPWlBIQ==;EndpointSuffix=core.windows.net
```
Both "AccountName" and "AccountKey" can be taken from here.

Retrieve Access Keys
Note: if you use the blob storage as an output storage for encoded videos you can enable public access to allow the video streaming for your consumers and for editors in the management system to preview the encoded videos. Never do this for the source blob storage though!

First you need to set Allow Blob Anonymous Access to Enabled.

Allow Blob Anonymous Access

Next, you need to go to your output storage container, select Change access level and set Anonymous access level to Blob(anonymous read access for blobs only).

Change Access Level
If you try to play a video you have encoded, sometimes you may encounter a CORS error. If you face this issue, you need to enable CORS for the domain that you are trying to access Azure storage.

Go to your storage account and click on Resource sharing (CORS) under Settings. Then add the allowed origins, methods, headers, and exposed headers as needed and save the configurations.

Configure CORS Settings

Otherwise you can use Azure CLI to configure CORS settings.
1. Install Azure CLI: Follow the documentation for installation guide
2. Login to Azure: az login
3. Configure CORS settings:
```
az storage cors add --methods GET POST --origins https://vtb.axinom.com --services b --account-name <your_storage_account_name> --account-key <your_storage_account_key>
```