Azure Blob Storage Setup for Chipmunk

This guide walks you through setting up an Azure Blob Storage account and generating a SAS URL that you will need when deploying the Chipmunk appliance. This is step 2 of the four-step Chipmunk setup; if you haven't completed App Registration yet, do that first.

Overview

Chipmunk stores all archived OneDrive, Exchange, and Teams data in your Azure Blob Storage account. You must create a storage account, a container, and generate a SAS URL with the correct permissions.

You’ll enter this SAS URL during the Chipmunk appliance setup process.

Step 1: Create a Storage Account

1. Log into Azure Portal
2. Search for Storage accounts
3. Click + Create
4. Fill out:

• Subscription: Your Azure subscription
• Resource group: Create or select one
• Storage account name: e.g., chipmunkarchive
• Region: Choose the same region as your Microsoft 365 tenant if possible
• Performance: Standard
• Redundancy: LRS or your preferred redundancy option

5. Click Review + create, then Create

Step 2: Create a Blob Container

1. In the Storage Account, go to Containers
2. Click + Container
3. Name it something like chipmunkarchive
4. Set Public access level to Private (no anonymous access)
5. Click Create

Step 3: Generate a SAS URL

1. In the Storage Account, click Shared access signature
2. Select the following permissions:

• Read (r)
• Add (a)
• Create (c)
• Write (w)
• Delete (d)
• List (l)

3. Set:

• Start time: Now (or backdated by 15 minutes to avoid clock drift issues)
• Expiry time: Several years in the future (e.g., 2030)

4. Select:

• Allowed services: Blob
• Allowed resource types: Container, Object
• Protocol: HTTPS only (recommended)

5. Click Generate SAS token and URL
6. Copy the full Blob service SAS URL

It should look like this:

https:.blob.core.windows.net/?sp=racwdl&st=2025-05-14T02:01:06Z&se=2030-05-14T10:01:06Z&spr=https&sv=2024-11-04&sr=c&sig=//

Step 4: Save the SAS URL

You will need to paste this URL into the Chipmunk setup wizard after you deploy the appliance. We recommend storing it somewhere secure until then.

Do not modify the config.json manually - Chipmunk’s setup process will populate it for you.

Tips

• Ensure the SAS token is long-lived (multi-year) to avoid service interruptions.
• Do not use storage account keys - only use the generated SAS URL.
• The container name and URL must match exactly.

Next: Set up your DNS and TLS certificate

Common questions

Q: Which Azure region should I put the storage account in?

• The same region as your Microsoft 365 tenant where possible - it minimises cross-region egress charges and gives the fastest archive throughput. If you don't know the tenant region, ask Microsoft 365 admin support or check Entra ID's geographic configuration. If your tenant spans regions (multi-geo), pick the region containing the majority of users being archived.

Q: Why a SAS URL and not the storage account key?

• A container-scoped SAS gives Chipmunk exactly the permissions it needs (read, add, create, write, delete, list within one container) without exposing the storage account key - which would let anything with the key access every container in the account. If the SAS is ever compromised, you regenerate it without rotating the account key. This is also why we recommend HTTPS-only and a multi-year expiry: long enough that you're not constantly regenerating, short enough that an expired SAS becomes a forcing function to rotate.

Q: What if the SAS URL expires?

• Chipmunk will start failing writes to the container. Generate a new SAS URL with the same permission set and update it in the appliance via the Configuration page. To avoid surprises, set a calendar reminder a month before expiry and watch the Monitoring & Logs for storage-write errors.

Q: Can I use an existing storage account that holds other data?

• Yes - Chipmunk only writes into the container you specify in the SAS URL. As long as that container is dedicated to Chipmunk (we recommend chipmunkarchive), there's no conflict. Just don't reuse a container that other tools write to; mixing data sources in one container makes archive auditing harder.

Q: What redundancy option should I pick - LRS, GRS, ZRS?

• LRS (Locally Redundant Storage) is the cheapest and is fine for most archive use cases - the data lives in three copies within one Azure region. For compliance scenarios that require geographic redundancy, choose GRS or RA-GRS. For mission-critical archives where the cost of losing access for hours is unacceptable, ZRS spreads the data across availability zones within the region. Decision is yours; Chipmunk works with any of them.