Microsoft Azure Blob Storage

When you use IAM delegated access to add your asset (data rows) to Labelbox, you can keep your assets in Microsoft Azure Blob Storage and grant Labelbox read-only access to your Azure storage containers.

📘

Azure Data Lake Storage

Labelbox is currently not compatible with ADLS Gen2. To set up this integration, you must use Azure Blob Storage.

Step 1: Get tenant ID and container URL

First, you must get the relevant information for this integration from your Microsoft Azure account.

1. Navigate to your Azure blob storage container that you want to use with Labelbox.

2. Navigate to Azure Active Directory and select the desired tenant (Tenant ID) you want to use with Labelbox.

Step 2: Create Azure integration in Labelbox

Next, open up a new integration in Labelbox and input the information you gathered in the previous section.

1. Log into Labelbox.

2. Navigate to the Integrations tab and click New integration.

3. Select Microsoft Azure integration.

4. Enter the details from Step 1.

5. If this is your first time setting this up, please use Add Labelbox to Azure tenant to add Labelbox to your Azure tenant.

You will be redirected to a Microsoft login page; note you need a certain level of permission to do so.

By doing so, Labelbox will create an Enterprise application in your Azure that serves a service account to handle the delegation at the storage account

• This is a one-time operation that allows you to bind your Labebox workspace to your Azure infra.

Step 3: Grant the permissions to the Labelbox app

Now, you must assign roles to the Storage Account; container(s) will inherit its permission.

Storage Blob Delegator

1. Navigate to Access Control (IAM) page within your Storage account.

2. Select Add role assignment and set Role to Storage Blob Delegator, and then assign access to labelbox_azure_delegated_access app.

Storage Blob Data Reader

1. Navigate to Access Control (IAM) page within your Container (or your Storage account).

2. Click Add role assignment, Add Storage Blob Data Reader and assign to Labelbox Delegated Access app.

📘

RBAC changes can take up to 30 mins

If you are running into any issues, such as the dataset not loading in Labelbox, it is likely that the permissions are not applied correctly. Any role-based-access-control (RBAC) changes you make can take up to 30 mins to take into effect. Learn more.

Step 4: Validate the integration

In this final step, return to the Integrations tab in the Labelbox and check whether the integration setup was successful.

📘

Example Azure URL

Ensure that you are using Azure URLs when creating datasets. Read Azure docs to learn how to generate blob URLs in a container (i.e: https://mlse.blob.core.windows.net/cloud-bucket-azure/image_1.jpg )

Step 5: Set up CORS headers

Follow these steps to set the CORS Headers

Now proceed to generate a JSON file containing Azure Blob Storage URIs.

Step 6: Upload data

Now that the connection is established use the SDK to connect data to Labelbox. Click through the links below to find the import format and instructions for uploading your data type.

Additional steps

Anonymous access level

For further security, we advise that your container be set to Private to make sure no unauthorized access is possible

Networking

You can also, from the Storage account, restrict specific IP ranges to add a layer of control in your data access, if you choose to do so, make sure to include Labelbox server addresses and all the intended users who need access.

1. From the Storage account, go to Security + networking, Networking
2. While Enabled from selected virtual networks and IP addresses is selected, you can add IP addresses that are allowed to access the Storage account and Containers