Skip to main content
Version: Next

Azure Integrations

Spice.ai integrates with Microsoft Azure for data federation, AI inference, embeddings, and authentication. This page consolidates Azure-compatible components and links to the relevant configuration guides.

Data Connectors​

Data connectors federate SQL queries across Azure data sources without data movement.

ConnectorDescriptionDocumentation
Azure Blob Storage / ADLS Gen2Query Parquet, CSV, and JSON files in Azure Blob Storage or ADLS Gen2 using the abfs:// scheme.ABFS Data Connector
Azure SQL Database / SQL ServerConnect to Azure SQL Database, Azure SQL Managed Instance, and SQL Server VMs.MSSQL Data Connector
Azure Database for PostgreSQLConnect to flexible server and single server deployments using the PostgreSQL connector.PostgreSQL Data Connector
Azure Database for MySQLConnect to flexible server deployments using the MySQL connector.MySQL Data Connector
Azure DatabricksQuery Databricks tables on Azure using SQL Warehouse or Spark Connect.Databricks Data Connector
Apache Iceberg (ADLS)Query Iceberg tables stored in ADLS Gen2 with REST or Unity Catalog metadata.Iceberg Data Connector
Delta Lake (ADLS)Query Delta Lake tables stored in ADLS Gen2 or Azure Blob Storage.Delta Lake Data Connector
Microsoft SharePointIndex and query documents from SharePoint sites and OneDrive for Business with Microsoft Entra ID authentication.SharePoint Data Connector
Azure-hosted databases via ODBCConnect through ODBC drivers for additional Azure-compatible data sources.ODBC Data Connector

Example: Azure Blob Storage (ABFS)​

datasets:
  - from: abfs://[email protected]/path/to/data/
    name: events
    params:
      file_format: parquet
      abfs_account: account
      abfs_use_emulator: 'false'

Example: Azure SQL Database​

datasets:
  - from: mssql:dbo.orders
    name: orders
    params:
      mssql_host: my-server.database.windows.net
      mssql_port: 1433
      mssql_database: mydb
      mssql_username: ${ secrets:MSSQL_USER }
      mssql_password: ${ secrets:MSSQL_PASSWORD }

The connector authenticates with a SQL Server login and encrypts the connection by default. It does not support Microsoft Entra ID authentication: an Authentication= keyword in mssql_connection_string is ignored, and the connection is attempted as a SQL Server login.

Example: Azure Databricks​

datasets:
  - from: databricks:catalog.schema.table
    name: orders
    params:
      mode: spark_connect
      databricks_endpoint: my-workspace.azuredatabricks.net
      databricks_cluster_id: 1234-567890-abcde123
      databricks_token: ${ secrets:DATABRICKS_TOKEN }

Catalog Connectors​

Catalog connectors provide schema discovery and unified access to tables in Azure data catalogs.

ConnectorDescriptionDocumentation
Databricks Unity CatalogDiscover and query tables governed by Unity Catalog on Azure Databricks. Supports Azure Blob authentication for table data.Unity Catalog
Databricks CatalogConnect to Azure Databricks as a catalog source for federated queries.Databricks Catalog

Example: Unity Catalog with Azure Blob​

catalogs:
  - from: unity_catalog:https://my-workspace.azuredatabricks.net/api/2.1/unity-catalog/catalogs/my_catalog
    name: my_catalog
    params:
      unity_catalog_token: ${ secrets:DATABRICKS_TOKEN }
      unity_catalog_azure_storage_account_name: mystorageacct
      unity_catalog_azure_storage_client_id: ${ secrets:AZURE_CLIENT_ID }
      unity_catalog_azure_storage_client_secret: ${ secrets:AZURE_CLIENT_SECRET }

AI Models (Azure OpenAI)​

Spice integrates with Azure OpenAI Service for chat completion and reasoning models, including GPT-4 family, GPT-5, and o-series models.

ProviderSupported ModelsDocumentation
Azure OpenAIGPT-4, GPT-4o, GPT-5, o-series, and other deployments.Azure OpenAI Models

Example: Azure OpenAI Chat Model​

models:
  - from: azure:gpt-4o
    name: gpt
    params:
      endpoint: ${ secrets:SPICE_AZURE_AI_ENDPOINT }
      azure_deployment_name: gpt-4o
      azure_api_version: 2024-08-01-preview
      azure_api_key: ${ secrets:SPICE_AZURE_API_KEY }

For Microsoft Entra ID authentication instead of an API key, set azure_entra_token in place of azure_api_key.

Secret Stores​

Spice resolves secrets at runtime from configured secret stores. For Azure deployments, the azure_keyvault store reads secrets directly from Azure Key Vault, so Spicepods can reference connector and model credentials without baking them into environment variables or values.yaml.

ProviderSupported Auth MethodsDocumentation
Azure Key Vaultservice_principal, managed_identity, workload_identity, cli, default.Azure Key Vault Secret Store

Example: Azure Key Vault Secret Store​

secrets:
  - from: azure_keyvault:prod-vault
    name: azure
    params:
      auth_method: workload_identity

datasets:
  - from: postgres:public.taxi_trips
    name: taxi_trips
    params:
      pg_host: postgres.example.com
      pg_user: ${azure:postgres_user}
      pg_pass: ${azure:postgres_password}

Logical key names use underscores; the store automatically translates them to Key Vault names like spice-postgres-user (with a fallback to postgres-user). Pair azure_keyvault with AKS workload identity or a Container Apps managed identity so the runtime authenticates without long-lived credentials.

Embeddings (Azure OpenAI)​

Generate vector embeddings using Azure OpenAI deployments for semantic search and retrieval-augmented generation (RAG).

ProviderSupported ModelsDocumentation
Azure OpenAItext-embedding-3-small, text-embedding-3-large, text-embedding-ada-002.Azure OpenAI Embeddings

Example: Azure OpenAI Embeddings​

embeddings:
  - from: azure:text-embedding-3-small
    name: azure_embed
    params:
      endpoint: ${ secrets:SPICE_AZURE_AI_ENDPOINT }
      azure_deployment_name: text-embedding-3-small
      azure_api_version: 2023-05-15
      azure_api_key: ${ secrets:SPICE_AZURE_API_KEY }

Refer to the Azure OpenAI Service models for the full list of supported models and regions.

Authentication​

Spice does not use the Azure Identity DefaultAzureCredential chain. Each integration resolves Azure credentials on its own:

IntegrationCredentials
Azure Blob Storage / ADLS Gen2Explicit abfs_* authentication parameters must name at most one method, and client credentials need all three of abfs_client_id, abfs_client_secret, and abfs_tenant_id, or the dataset fails to load. abfs_* parameters then override AZURE_* environment variables, and the first complete credential wins: bearer token, account key, workload identity (AZURE_FEDERATED_TOKEN_FILE), service principal secret, SAS token, Azure CLI (only with abfs_use_cli: true), then managed identity. Certificate and username/password credentials are not used.
Azure Key VaultChosen by auth_method. default uses a service principal when client_secret is set, and otherwise the Azure CLI or Azure Developer CLI login. Managed and workload identity require auth_method: managed_identity or auth_method: workload_identity.
Azure SQL DatabaseA SQL Server login in mssql_connection_string, or mssql_username and mssql_password. Microsoft Entra ID authentication is not supported.
Azure OpenAIazure_api_key or azure_entra_token.

For the order in detail, see the Authentication section of the Azure deployment guide.

Role Assignments​

Each principal must have the appropriate Azure RBAC role for the services it accesses:

ServiceCommon role(s)
Azure Blob Storage / ADLS Gen2Storage Blob Data Reader or Storage Blob Data Contributor
Azure Key VaultKey Vault Secrets User (data plane) or RBAC equivalent
Azure SQL DatabaseDatabase permissions granted to the SQL login
Azure OpenAICognitive Services OpenAI User
Azure Container RegistryAcrPull for image pulls

When a Spicepod connects to multiple Azure services, ensure roles are granted on every resource the runtime touches.

Cookbooks​

  • Azure OpenAI Models — vector search and chat over structured and unstructured data with Azure OpenAI.