Generate Azure file share SAS URL for PI bulk import

Completed by: Azure account holder

Create and run the script provided at the end of this topic to generate a 7-day, read-only Shared Access Signature (SAS) URL for a customer-owned classic Azure file share in your organization's Azure subscription. CONNECT uses this SAS URL to read staged files during PI bulk import.

Important: Coordinate with the CONNECT operator and generate the SAS token shortly before they create and start the PI bulk import. The token expires 7 days after Azure issues it and must still be valid when the CONNECT operator starts the import.

Prerequisites

• A workstation with Azure CLI version 2.42.0 or later installed and available on its PATH. You can create and run the script on any workstation that meets this requirement. For installation steps, see Install the Azure CLI.

• The Azure account holder who runs this script uses a Microsoft SSO user account in Azure that has the roles Storage File Delegator and Storage File Data Privileged Reader, as assigned during Configure Azure file share prerequisites.

• Artifacts and information provided by the Azure account holder, if they are different from the person completing this task:

  • The Azure subscription, storage account, and file share that contain the staged PI Archive data files.

  • The tenant ID if the Azure account holder's account can access multiple Microsoft Entra tenants.

• Artifacts and information provided by the PI Server administrator:

  • Confirmation that the required files are staged in the root-level CONFIG directory.

To generate Azure file share SAS URL for PI bulk import

1. Create Create-FileShareSAS.ps1 in the script working directory by copying the script in Create-FileShareSAS.ps1 within this topic to a text file.

2. Open PowerShell, and then set the current working directory (PWD) to the folder that contains Create-FileShareSAS.ps1

   cd <path-to-directory-containing-Create-FileShareSAS.ps1>

3. Run Create-FileShareSAS.ps1

   Run Create-FileShareSAS.ps1 from PowerShell to generate a SAS URL for the target classic Azure file share.

   The script authenticates by using the Azure CLI login identity (--as-user --auth-mode login), so you do not need a storage account key.

   Usage:

   .\Create-FileShareSAS.ps1 -StorageAccountName <account> -FileShareName <share> [-TenantId <tenant>]

   Usage parameters:

   • StorageAccountName (required): The name of the Azure storage account that contains the file share.

   • FileShareName (required): The name of the file share to generate a SAS URL for.

   • TenantId (optional): The ID of the Microsoft Entra tenant associated with the user account that runs the script. If you omit this parameter, the script uses the default tenant for the signed-in account. Use this parameter when the user account can access multiple tenants.

     Example (specific tenant with optional TenantId parameter):

     powershell .\Create-FileShareSAS.ps1 -StorageAccountName "windtopiastorage" -FileShareName "turbine-data" -TenantId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

4. When prompted, select the appropriate Azure subscription to use.

   Azure CLI prompts you to select the subscription to use.

5. Record the script output values.

   Save the output values that you need for later steps, including the full SAS URL printed by the script in this format:

   https://<StorageAccountName>.file.core.windows.net/<FileShareName>?<sas-token>

   Record the SAS token expiration time, permissions, and allowed protocol. The generated token expires in 7 days, grants list and read permissions only (lr), and is restricted to HTTPS connections.

6. Complete the handoff to the CONNECT operator by following the instructions in Handoff to the CONNECT operator below.

Create-FileShareSAS.ps1

Copy the following text into a file named Create-FileShareSAS.ps1 in your working directory.

param(

[Parameter(Mandatory = $true)]

[string] $StorageAccountName,

[Parameter(Mandatory = $true)]

[string] $FileShareName,

[Parameter(Mandatory = $false)]

[string] $TenantId

)

if ($TenantId) {

az login --tenant $TenantId

} else {

az login

}

$expiryUtc = (Get-Date).ToUniversalTime().AddDays(7).ToString("yyyy-MM-ddTHH:mmZ")

$sas = az storage share generate-sas `

--as-user `

--auth-mode login `

--enable-file-backup-request-intent `

-n $FileShareName `

--account-name $StorageAccountName `

--https-only `

--permissions lr `

--expiry $expiryUtc `

-o tsv

$shareSasUrl = "https://$StorageAccountName.file.core.windows.net/$FileShareName`?$sas"

Write-Host

Write-Host $shareSasUrl

Handoff to the CONNECT operator

After the script completes, inform the CONNECT operator that all requirements for the PI bulk import are in place and they can begin the import. Provide the following values securely:

• The full Azure file share SAS URL.

• The SAS token expiration time, which is 7 days after Azure issues it.

• Confirmation that the token grants list and read permissions only (lr) and requires HTTPS.

• The storage account and file share names, and confirmation that the staged files are in the root-level CONFIG directory.

  Important: Provide the SAS URL and token to the CONNECT operator as soon as possible. The token must still be valid when the operator starts the import.

Direct the CONNECT operator to continue with Create and monitor PI bulk import.