Overview

Microsoft Azure provides Azure Blob Storage as a scalable object storage service. Bitmovin's Encoding API supports Azure Blob Storage as an output destination, allowing you to write encoded media files directly to your Azure containers.

This guide shows you how to configure an Azure Blob Storage output for use with Bitmovin encodings. Authenticate with Microsoft Entra ID service principal (recommended) or an account key (legacy).

IMPORTANT: This tutorial assumes you already created an Azure Storage Account and a Blob container. If you don't have these set up yet, refer to Microsoft's Azure documentation to create them first.

Prerequisites

Before creating a Bitmovin Azure Blob Storage output, you need to gather the following information from your Azure portal:

Storage Account Name (e.g., mystorageaccount)
Container Name (e.g., myoutputcontainer)
One of the following
- [Encoder version starting from 2.273.0] Microsoft Entra ID service principal
  - Client ID, Tenant ID, and Client Secret of the Entra ID service principal
  - Client ID, Tenant ID, and Client Certificate of the Entra ID service principal
- [Encoder version older than 2.273.0] account key (legacy)
  - Account Key (primary or secondary access key from your storage account)

Client Certificate – A PEM-encoded string containing both the private key and the certificate, concatenated in any order. Preserve newline characters in the string.

Locating and configuring these values in the Azure portal

Navigate to your Storage Account
For Account Name: visible at the top of the storage account overview
For Container Name: go to Containers in the left menu
One of the following
1. For Microsoft Entra ID service principal
  1. Create an Azure service principal and setup the according authentication method
  2. Assign the required role to your service principal. In the storage account's left-hand menu, select Access control (IAM) and assign the Storage Blob Data Contributor role to your service principal.
2. For Account Key: go to Access keys in the left menu under Security + networking

Create a Bitmovin Azure Blob Storage Output

To create a Bitmovin Azure Output configuration that can be used by the encoding service, you need the Storage Account Name, Container Name, and Account Key.

Use the Dashboard UI

Select the Encoding menu on the left and go to Outputs
Click on Create in the upper right corner of the Outputs overview
Select Azure as Output type
Enter all required fields:
- Name: A descriptive name for this output
- Account Name: Your Azure storage account name
- Container: Your blob container name
- One of the following
  - Client ID, Tenant ID, and Client Secret of the Azure service principal
  - Client ID, Tenant ID, and Client Certificate of the Azure service principal
  - Account Key: Your storage account access key
Click on Create

Use a Bitmovin API SDK

Each of our Open API SDKs implements the Bitmovin API, making it easy to integrate with your project. Use them to create reusable output resources for your encodings:

Bitmovin API SDK - Output example using Entra ID

import com.bitmovin.api.sdk.BitmovinApi;
import com.bitmovin.api.sdk.model.AzureOutput;
import com.bitmovin.api.sdk.model.AzureServicePrincipal;

BitmovinApi bitmovinApi = BitmovinApi.builder()
        .withApiKey("YOUR_BITMOVIN_API_KEY")
        .build();

private AzureOutput createAzureOutput(String storageAccountName, String containerName,
                                      String clientId, String tenantId,
                                      String clientSecret, String clientCertificate)
        throws Exception {
    AzureServicePrincipal servicePrincipal = new AzureServicePrincipal();
    servicePrincipal.setClientId(clientId);
    servicePrincipal.setTenantId(tenantId);
    servicePrincipal.setClientSecret(clientSecret);            // provide either clientSecret
    servicePrincipal.setClientCertificate(clientCertificate);  // or clientCertificate

    AzureOutput azureOutput = new AzureOutput();
    azureOutput.setName(storageAccountName);
    azureOutput.setAccountName(storageAccountName);
    azureOutput.setContainer(containerName);
    azureOutput.setServicePrincipal(servicePrincipal);

    return bitmovinApi.encoding.outputs.azure.create(azureOutput);
}

// Using clientSecret
AzureOutput azureOutput = createAzureOutput(
        "mystorageaccount", "my-output-container",
        "your_client_id", "your_tenant_id",
        "your_client_secret", null);

// Using clientCertificate
AzureOutput azureOutput = createAzureOutput(
        "mystorageaccount", "my-output-container",
        "your_client_id", "your_tenant_id",
        null, "your_client_certificate");

from bitmovin_api_sdk import BitmovinApi
from bitmovin_api_sdk.models import AzureOutput, AzureServicePrincipal

bitmovin_api = BitmovinApi(api_key='YOUR_BITMOVIN_API_KEY')

def create_azure_output(storage_account_name, container_name, client_id, tenant_id,
                        client_secret=None, client_certificate=None):
    azure_output = AzureOutput(
        name=storage_account_name,
        account_name=storage_account_name,
        container=container_name,
        service_principal=AzureServicePrincipal(
            client_id=client_id,
            tenant_id=tenant_id,
            client_secret=client_secret,         # provide either client_secret
            client_certificate=client_certificate  # or client_certificate
        )
    )
    return bitmovin_api.encoding.outputs.azure.create(azure_output)


# Using client_secret
azure_output = create_azure_output(
    storage_account_name='mystorageaccount',
    container_name='my-output-container',
    client_id='your_client_id',
    tenant_id='your_tenant_id',
    client_secret='your_client_secret'
)

# Using client_certificate
azure_output = create_azure_output(
    storage_account_name='mystorageaccount',
    container_name='my-output-container',
    client_id='your_client_id',
    tenant_id='your_tenant_id',
    client_certificate='your_client_certificate'
)

See all available examples for each of our Bitmovin API SDKs in our GitHub Example Repository.

Using the Output in an Encoding

Once the output is created, reference it when defining muxing output paths:

EncodingOutput encodingOutput = new EncodingOutput();
encodingOutput.setOutputId(azureOutput.getId());
encodingOutput.setOutputPath("/my-encoding-job/output/");

from bitmovin_api_sdk import EncodingOutput

encoding_output = EncodingOutput(
    output_id=azure_output.id,
    output_path='/my-encoding-job/output/'
)

Azure CDN vs. Azure Blob Storage

Bitmovin outputs encoded files directly to Azure Blob Storage, not to Azure CDN or Azure Edge CDN.

To serve content via Azure CDN, configure your CDN to pull from the Blob Storage container after encoding is complete. Manage this outside the Bitmovin configuration through your Azure CDN settings.

Common Issues

Authentication failure on encoding:

An incorrectly formatted account key commonly causes authentication failures. Copy the key directly from the Azure portal without adding spaces, line breaks, or modifying the base64 string.

File transfer failure with special characters:

Filenames containing spaces or special characters (e.g., ProRes 8 channels.mov) can cause transfer failures. Best practice: use only alphanumeric characters, hyphens, and underscores in output paths and filenames.

Slow upload times:

If you experience persistent slow upload times to Azure Blob Storage under high I/O load, raise a support case with Azure to investigate potential throttling on your storage account.

Setting up an Azure Blob Storage Output