Azure Storage

Manage data plane resources in Azure Storage accounts, such as blob containers, blobs, queues and tables.

Community Maintained

Version	0.0.1
Artifact	br:ghcr.io/anthony-c-martin/bicep-ext-storage:0.0.1
Source	github.com/anthony-c-martin/bicep-ext-storage
Publisher	anthony-c-martin
Licence	MIT
Category	Azure

Installation

Register the extension in bicepconfig.json:

{
  "experimentalFeaturesEnabled": {
    "localDeploy": true,
    "ociEnabled": true
  },
  "implicitExtensions": [],
  "extensions": {
    "storage": "br:ghcr.io/anthony-c-martin/bicep-ext-storage:0.0.1"
  }
}

Then reference it from your Bicep file:

extension storage

Configuration

Configuration is supplied using extension storage with { ... }.

Property	Type	Attributes	Description
accountName	string	Required	The storage account name
accessToken	string	Sensitive	A Microsoft Entra access token for 'https://storage.azure.com'.
accountKey	string	Sensitive	A storage account shared key. Required for operations that do not support Microsoft Entra authentication, such as table stored access policies.
blobEndpoint	string		The blob service endpoint. Defaults to 'https://<accountName>.blob.<endpointSuffix>'. Set this to target an emulator or a custom domain.
dfsEndpoint	string		The Data Lake Storage Gen2 (DFS) endpoint. Defaults to 'https://<accountName>.dfs.<endpointSuffix>'.
endpointSuffix	string		The storage endpoint suffix. Defaults to 'core.windows.net'.
fileEndpoint	string		The file service endpoint. Defaults to 'https://<accountName>.file.<endpointSuffix>'.
queueEndpoint	string		The queue service endpoint. Defaults to 'https://<accountName>.queue.<endpointSuffix>'.
sasToken	string	Sensitive	A shared access signature token, with or without a leading '?'.
tableEndpoint	string		The table service endpoint. Defaults to 'https://<accountName>.table.<endpointSuffix>'.
useDefaultAzureCredential	bool		Whether to authenticate with DefaultAzureCredential (environment, workload identity, managed identity, Azure CLI, ...). Defaults to true when no other credential is supplied.

Authentication

The extension talks to Azure Storage over the data plane. Several credential types are supported, and the right one depends on the operation:

Credential	Configuration property
Microsoft Entra (default)	useDefaultAzureCredential
Microsoft Entra access token	accessToken
Shared key	accountKey
Shared access signature	sasToken

When no credential is supplied, useDefaultAzureCredential defaults to true, which picks up environment variables, workload identity, managed identity or an Azure CLI login — whichever is available.

extension storage with {
  accountName: 'contosostorage'
}

Some operations, such as table stored access policies, are not supported by Microsoft Entra authentication and require accountKey.

Targeting an emulator

Override the service endpoints to point at Azurite or a custom domain:

extension storage with {
  accountName: 'devstoreaccount1'
  blobEndpoint: 'http://127.0.0.1:10000/devstoreaccount1'
  queueEndpoint: 'http://127.0.0.1:10001/devstoreaccount1'
  tableEndpoint: 'http://127.0.0.1:10002/devstoreaccount1'
  accountKey: azuriteKey
}

Example

targetScope = 'local'

extension storage with {
  accountName: 'contosostorage'
}

resource container 'BlobContainer' = {
  name: 'documents'
}

resource readme 'Blob' = {
  containerName: container.name
  name: 'readme.txt'
  content: 'Uploaded with Bicep'
}

Notes

• This extension manages data plane resources. The storage account itself is still created with the standard Microsoft.Storage/storageAccounts Azure resource type.
• Because the data plane is reached directly, the machine running the deployment needs network access to the account.

Samples

5 example Bicep files are available under Samples.

Resource types

This extension exposes 10 resource types, documented under Reference.

Reference generated from ghcr.io/anthony-c-martin/bicep-ext-storage:0.0.1 on 2026-08-23.