Azure Blob Storage

To export data from Worklytics to Azure (Blob Storage) containers, you can set up a Data Export Connection in the Worklytics Web App selecting Google Cloud Storage as Data Destination.

How it works

Your organization, as tenant of the Worklytics platform, is assigned with a Google Cloud Platform (GCP) service account (SA) that will be used to export the data to your GCS bucket via Workload Identity Federation.

Your tenant SA must be granted with the necessary permissions to access your Azure Blob Storage container where data will be exported.

Pre-requisites

1. Take note of your Worklytics' tenant SA Unique ID: you can find this value in the Export Data Configuration page of the Worklytics Web App, and also on the UI to create the data export itself.

2. Go to the Azure Portal and select a Storage Account (or create a new one).

3. Inside the Storage Account, create a new container (or choose an existing one).

4. Go to the Entra ID section of the portal and create a new application registration. Note the application's cliend ID (this is the "Application ID" value in the properties section of the application).

5. Setup Federated Identity Credentials for the application: go to the "Certificates & secrets" section of the application and create a new Credential with the following values:

   • Federated credential scenario: choose "Other issuer"

   • Issuer: https://accounts.google.com

   • Subject identifier: your Worklytics' tenant SA Unique ID

   • Audience: api://AzureADTokenExchange

6. Now, go to the "Access control (IAM)" section of the Storage Account and add a new role assignment using:

   • Role assignment: Storage Blob Delegator

   • Member granted with the role: The Service Principal that represents the application.

7. Repeat the same step, this time inside the container you've created:

   • Role assignment: Storage Blob Data Contributor

   • Member granted with the role: The Service Principal that represents the application.

Note: role assignment changes may take a few minutes to take effect.

8. Finally, take note of the values you'll need to provide when configuring the Data Export in the Worklytics Web App:

   • Storage Account Name

   • Container Name

   • Application ID (Client ID)

   • Tenant ID: in the Azure portal, find this under "Home > Microsoft Entra ID > Overview > Tenant ID".

Setting up the connection

1. Go to the Data Export Connection section in the Worklytics Web App.

2. Select the dataset you want to export, and its frequency.

3. Select Azure as Data Destination, and enter all the values from the step number 7 of the pre-requisites.

4. Select the format and compression options, and click on "Create Export".