Is azCopy command supported for using mTLS?

We are considering using azCopy command to permit clients to copy files to Azure Blob Storage. The transport layer security must use mTLS.

The following command from https://learn.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-login, looks like it should achieve mTLS connection. However, it requires the client to use service principal in addition to a client cert. We cannot use service principal.

  azcopy login --service-principal --certificate-path /path/to/my/cert --application-id <your service principal's application ID>

Am I correct that mTLS works with this command, however a service principal must also be used? Any thoughts on how I can achieve mTLS communication without need of service principal?

Am I correct that mTLS works with this command, however a service principal must also be used? Any thoughts on how I can achieve mTLS communication without need of service principal?

Yes, you are correct that the azCopy login command supports mTLS, but it requires the use of a service principal in addition to the client certificate. This is because the service principal is used for authentication and authorization purposes while the client certificate is used for secure communication.

However, if you cannot use a service principal, you may consider or alternate approach using other Azure tools or libraries that support mTLS without the need for a service principal.

You can use Python-sdk to authenticate with mTLS using only a client certificate.

Code:

from azure.storage.blob import BlobServiceClient
from azure.core.credentials import AzureSasCredential

# Specify the path to your client certificate
client_cert_path = "<your certificate path>"

# Specify the URL of your Azure Blob Storage account
account_url = "https://<storageaccount name>.blob.core.windows.net"
path="<your files path>"

# Create a BlobServiceClient with mTLS authentication using the client certificate
credential = AzureSasCredential("<?sastoken>")
blob_service_client = BlobServiceClient(account_url=account_url, credential=credential, transport_type="mtls", client_cert_path=client_cert_path)

# Use the BlobServiceClient to perform operations on your Blob Storage container
container_client = blob_service_client.get_container_client("test3")
blob_client = container_client.get_blob_client("sample.html")
with open(path, "rb") as data:
 blob_client.upload_blob(data)
 

Portal:

Reference:

azure.storage.blob.BlobServiceClient class | Microsoft Learn