Overview

Microsoft Azure provides Azure Blob Storage as a scalable object storage service. Use Azure Blob Storage as a Bitmovin Encoding API input source to encode media files from your Azure containers.

Configure an Azure Blob Storage input for Bitmovin encodings with Microsoft Entra ID service principal (recommended) or an account key (legacy).

IMPORTANT: Create an Azure Storage Account and a Blob container before you start. To set these up, see Microsoft's Azure documentation.

Prerequisites

Gather the following information from your Azure portal before you create a Bitmovin Azure Blob Storage input:

Storage Account Name (e.g., mystorageaccount)
Container Name (e.g., myinputcontainer)
One of the following
- [Encoder version starting from 2.273.0] Microsoft Entra ID service principal
  - Client ID, Tenant ID, and Client Secret
  - Client ID, Tenant ID, and Client Certificate
- [Encoder version older than 2.273.0] account key (legacy)
  - Account Key (primary or secondary access key from your storage account)

Client Certificate – A PEM-encoded string containing both the private key and the certificate, concatenated in any order. Preserve newline characters in the string.

Locating and configuring these values in the Azure portal

Navigate to your Storage Account
For Account Name: visible at the top of the storage account overview
For Container Name: go to Containers in the left menu
One of the following
1. For Microsoft Entra ID service principal
  1. Create an Microsoft Entra ID service principal and setup the according authentication method
  2. Configure the required storage account role. In the left-hand menu, select Access control (IAM) and assign the Storage Blob Data Contributor role to your service principal.
2. For Account Key: go to Access keys in the left menu under Security + networking

Create a Bitmovin Azure Blob Storage Input

Create a Bitmovin Azure Input configuration with the Storage Account Name, Container Name, and one authentication method.

Use the Dashboard UI

Select the Encoding menu on the left and go to Inputs
Click on Create in the upper right corner of the Inputs overview
Select Azure as Input type
Enter all required fields:
- Name: A descriptive name for this input
- Account Name: Your Azure storage account name
- Container: Your blob container name
- One of the following
  - Client ID, Tenant ID and Client Secret of the Azure service principal
  - Client ID, Tenant ID and Client Certificate of the Azure service principal
  - Account Key: Your storage account access key
Click on Create

Use a Bitmovin API SDK

Each of our Open API SDKs implements the Bitmovin API, making it easy to integrate with your project. Use them to create reusable input resources for your encodings:

Bitmovin API SDK - Input example using Entra ID

import com.bitmovin.api.sdk.BitmovinApi;
import com.bitmovin.api.sdk.model.AzureInput;
import com.bitmovin.api.sdk.model.AzureServicePrincipal;

BitmovinApi bitmovinApi = BitmovinApi.builder()
        .withApiKey("YOUR_BITMOVIN_API_KEY")
        .build();

private AzureInput createAzureInput(String storageAccountName, String containerName,
                                    String clientId, String tenantId,
                                    String clientSecret, String clientCertificate)
        throws Exception {
    AzureServicePrincipal servicePrincipal = new AzureServicePrincipal();
    servicePrincipal.setClientId(clientId);
    servicePrincipal.setTenantId(tenantId);
    servicePrincipal.setClientSecret(clientSecret);            // provide either clientSecret
    servicePrincipal.setClientCertificate(clientCertificate);  // or clientCertificate

    AzureInput azureInput = new AzureInput();
    azureInput.setName(storageAccountName);
    azureInput.setAccountName(storageAccountName);
    azureInput.setContainer(containerName);
    azureInput.setServicePrincipal(servicePrincipal);

    return bitmovinApi.encoding.inputs.azure.create(azureInput);
}

// Using clientSecret
AzureInput azureInput = createAzureInput(
        "mystorageaccount", "my-input-container",
        "your_client_id", "your_tenant_id",
        "your_client_secret", null);

// Using clientCertificate
AzureInput azureInput = createAzureInput(
        "mystorageaccount", "my-input-container",
        "your_client_id", "your_tenant_id",
        null, "your_client_certificate");

from bitmovin_api_sdk import BitmovinApi
from bitmovin_api_sdk.models import AzureInput, AzureServicePrincipal

bitmovin_api = BitmovinApi(api_key='YOUR_BITMOVIN_API_KEY')

def create_azure_input(storage_account_name, container_name, client_id, tenant_id,
                       client_secret=None, client_certificate=None):
    azure_input = AzureInput(
        name=storage_account_name,
        account_name=storage_account_name,
        container=container_name,
        service_principal=AzureServicePrincipal(
            client_id=client_id,
            tenant_id=tenant_id,
            client_secret=client_secret,         # provide either client_secret
            client_certificate=client_certificate  # or client_certificate
        )
    )
    return bitmovin_api.encoding.inputs.azure.create(azure_input)


# Using client secret
azure_input = create_azure_input(
    storage_account_name='mystorageaccount',
    container_name='my-input-container',
    client_id='client_id',
    tenant_id='tenant_id',
    client_secret='client_secret'
)

# Using client certificate
azure_input = create_azure_input(
    storage_account_name='mystorageaccount',
    container_name='my-input-container',
    client_id='client_id',
    tenant_id='tenant_id',
    client_certificate='client_certificate'
)

See all available examples for each of our Bitmovin API SDKs in our GitHub Example Repository.

Using SAS URLs as Input

Alternatively, use a direct Azure Blob SAS (Shared Access Signature) URL as the input path when creating an encoding job:

# Example SAS URL format
input_path = 'https://mystorageaccount.blob.core.windows.net/mycontainer/video.mp4?sp=r&st=2026-01-01T00:00:00Z&se=2026-02-01T00:00:00Z&spr=https&sv=2024-11-04&sr=b&sig=YOUR_SIGNATURE'

When using SAS URLs, ensure the token has read permissions and has not expired before the encoding job completes.

Common Issues

Authentication failure on encoding:

An incorrectly formatted account key commonly causes authentication failures. Always copy the key directly from the Azure portal without adding spaces, line breaks, or modifying the base64 string.

File transfer failure with special characters:

Filenames containing spaces or special characters (e.g., ProRes 8 channels.mov) can cause transfer failures. Best practice: use only alphanumeric characters, hyphens, and underscores in filenames.

Setting Up an Azure Blob Storage Input