Purpose
Record a possible future Workbench capability for managing Azure Storage accounts. This is an exploratory roadmap item only and is not part of Phase 12 or the current implementation plan.
Product idea
Use the existing Workbench authentication, request, output, assertion, and workflow model to provide a focused Azure Storage experience rather than attempting to recreate the full Azure portal.
Potential capabilities could include:
- Authenticate to Azure using supported Microsoft identity flows.
- Select subscriptions and enumerate accessible Storage accounts.
- Browse Blob containers and objects.
- Inspect object metadata, content type, size, ETag, lease state, and access tier.
- Upload and download blobs.
- Create containers and virtual folder prefixes.
- Copy, move, rename, or delete blobs with explicit destructive-action confirmation.
- Generate narrowly scoped, short-lived SAS access where permitted.
- Exercise Queue, File, or Table storage in later increments.
- Turn storage operations into reusable Workbench workflows with assertions and generated outputs.
- Support Azurite for deterministic local development and integration tests.
Possible first release
A read-only Blob Storage explorer is the preferred starting point:
- authenticate
- select subscription and Storage account
- list containers
- list and search blobs
- inspect metadata
- download a selected blob
Write and destructive operations should be separate follow-up work after the permission and safety model is proven.
Security and safety considerations
- Prefer Microsoft Entra ID and least-privilege RBAC over account keys.
- Integrate with authentication secret providers when available, without making Phase 12 depend on this issue.
- Never persist access tokens, account keys, connection strings, or SAS tokens in logs or execution history.
- Distinguish Azure Resource Manager management-plane calls from Storage data-plane calls.
- Require clear confirmation and exact target display for destructive operations.
- Define safe behavior for leases, snapshots, versions, soft delete, immutable storage, and retention policies.
- Test against Azurite where possible and use isolated Azure resources for hosted integration tests.
Out of scope for now
- Implementation in the current roadmap
- Full Azure portal replacement
- Azure Key Vault management
- Subscription, billing, networking, IAM, or policy administration
- Automatic destructive bulk operations
- Support for every Azure Storage service in the initial increment
Discovery required before scheduling
- Decide whether this belongs in core Workbench or an optional integration module.
- Validate the demand for management-plane discovery versus direct endpoint configuration.
- Select the supported identity flows and RBAC roles.
- Define the read-only Blob Storage MVP.
- Produce an architecture decision record and threat model.
- Prototype the complete flow with Azurite and a disposable Azure test account.
- Estimate the maintenance burden of Azure API and SDK version changes.
Purpose
Record a possible future Workbench capability for managing Azure Storage accounts. This is an exploratory roadmap item only and is not part of Phase 12 or the current implementation plan.
Product idea
Use the existing Workbench authentication, request, output, assertion, and workflow model to provide a focused Azure Storage experience rather than attempting to recreate the full Azure portal.
Potential capabilities could include:
Possible first release
A read-only Blob Storage explorer is the preferred starting point:
Write and destructive operations should be separate follow-up work after the permission and safety model is proven.
Security and safety considerations
Out of scope for now
Discovery required before scheduling