Deploy Blob Web Explorer in your Azure subscription

1. In the Azure portal, open Microsoft Entra ID → App registrations and select New registration.
2. Name it, for example Blob Web Explorer, and select Accounts in this organizational directory only.
3. Leave the redirect URI empty — you will add it after deployment — and select Register.
4. From the Overview page, note the Directory (tenant) ID and the Application (client) ID.

1. Open Certificates & secrets → New client secret, add a description and an expiry, then select Add.
2. Copy the secret Value immediately: it is shown only once.

Open Authentication, check ID tokens under Implicit grant and hybrid flows, and save.

Open App roles → Create app role three times, with Allowed member types set to Users/Groups:

Blob Web Explorer uses this single App Registration for three things: signing users in, reading your directory to help users share containers, and acting on behalf of the signed-in user when they browse Azure or open storage with their own Azure access. Each permission below is tied to a feature; none of them gives Blob Web Explorer access to your storage on its own.

How to add them

1. Open API permissions → Add a permission.
2. Microsoft Graph → Delegated permissions: check openid, profile, offline_access, and User.Read (usually already present), then Add permissions.
3. Microsoft Graph → Application permissions: check User.Read.All, Group.Read.All, and GroupMember.Read.All, then Add permissions.
4. Recommended: Add a permission → Azure Service Management → Delegated permissions → user_impersonation.
5. Recommended: Add a permission → Azure Storage → Delegated permissions → user_impersonation.
6. Select Grant admin consent for <your organization> and confirm. Every line must show the status Granted for <your organization>.

Azure Service Management and Azure Storage are listed under APIs Microsoft uses in older portals and under the Microsoft APIs tab otherwise. Granting admin consent requires a Cloud Application Administrator, Application Administrator, or Privileged Role Administrator.

Sign-in permissions (Microsoft Graph, delegated) — required

Directory permissions (Microsoft Graph, application) — required, admin consent

These are used by the application itself, without a signed-in user, and only to read your directory. Blob Web Explorer never creates, changes, or deletes users or groups.

Azure access on behalf of the user (delegated) — recommended

With these two permissions, Blob Web Explorer can act only with the Azure rights of the signed-in user and only during their session. They are not roles on your storage: a user without an Azure role on a storage account still cannot see or open it. Blob Web Explorer never uses its own identity to reach your containers.

Final check

In Azure Marketplace, search for Blob Web Explorer, select the plan, then Create. Choose the subscription, a resource group (a new one is recommended), the region, and the names below.

Application name

Name of the managed application resource, shown under Managed applications (for example blobexplorer-finance). Give this name to support when you contact us.

Managed resource group

Resource group that will contain the BlobExplorer resources (web app, monitoring). The application data storage account is yours and stays outside it. The proposed default name can be kept.

Workspace name (resource prefix)

Not the same as the Application name. Short prefix of 3 to 12 lowercase letters or digits used to name the resources and the web address of your BlobExplorer: https://app-bwe-<workspace>-<suffix>.azurewebsites.net. Use a name that identifies the instance, for example finance. Default: bwe.

Identity provider

Entra ID — App roles or Azure B2C — Groups.

Entra ID fields

Tenant ID, application (client) ID, and client secret from Phase 1. Enter the secret Value, not the Secret ID; the form rejects a client ID identical to the tenant ID.

Azure B2C fields

Tenant domain, tenant ID, application (client) ID, client secret (Value), and user flow name.

Prerequisites confirmation

Confirm that roles (Entra ID) or groups (B2C) exist, that at least one administrator is assigned, and that the Graph permissions have administrator consent.

Redirect URI confirmation

Confirm that you will add the redirect URI after deployment (step 12).

Choose Create a new plan and select a size:

Or choose Use an existing plan: the list only shows Linux App Service plans located in the deployment region with a Basic, Standard or Premium tier. An existing plan stays under your control; scaling it down, stopping it or deleting it affects Blob Web Explorer.

You can change the plan size after deployment. Large uploads (up to 195 GiB) are handled by the web application itself. Confirm the outbound network prerequisites to continue.

In the Network step, keep Public (default) or choose Private to make the application reachable only from your virtual network. See Private network access for the subnets and DNS to prepare beforehand.

Blob Web Explorer stores its own data (users, linked containers, shares, search index, activity) in tables of an existing storage account that you provide. The deployment never creates it. It must be a general-purpose v2 account, Standard tier, with the Table service. Choose how the application connects to it:

Managed identity (recommended)

Select the storage account in the list (accounts of the deployment subscription). No secret is stored. You grant the access after deployment (step 13).

Connection string

Paste the storage account connection string (it must contain the account name and key). It is stored securely in your deployment.

You can change the storage account or the method at any time from Administration → Data storage. Data is not copied automatically.

Create a new Application Insights resource (default), select an existing one, or choose not to use Application Insights. Without it, no telemetry or application logs are collected, which makes troubleshooting harder.

Review the summary, accept the terms, and select Create. The deployment usually completes in a few minutes.

1. Open the managed application in the Azure portal, then Parameters and Outputs. Copy webAppUrl and redirectUri.
2. On your App Registration, open Authentication → Add a platform → Web and paste the redirect URI. It has this form:

Only with the managed identity method. The deployment cannot do it because your storage account is outside the managed resource group.

1. In Parameters and Outputs, copy grantStorageAccessCommand and run it in Azure Cloud Shell (Azure CLI) with an account allowed to assign roles on the storage account. It has this form:

Or, in the portal: storage account → Access control (IAM) → Add role assignment → Storage Table Data Contributor → Managed identity → select the web app (its object ID is the webAppPrincipalId output).

• Entra ID: open Enterprise applications, select your application, then Users and groups → Add user/group, and assign BWE.Admin.
• Azure AD B2C: add the user directly to the BWE_Admin group.

Users without a role can still sign in with Reader access. Assign Contributor or Reader to other users the same way.

Open the webAppUrl, sign in as the administrator, and open Administration → Deployment checklist. The checklist confirms that identity, roles, and configuration are ready. Review Administration → Admin settings for the deployment context.