spiceai/docs

title: 'Azure Integrations' description: 'Spice.ai integrations with Microsoft Azure, including data connectors, AI models, embeddings, and authentication.' sidebar_label: 'Integrations' sidebar_position: 2 pagination_next: null keywords: [ spice.ai, azure, blob storage, adls, azure sql, azure openai, databricks, aks, container apps, sharepoint, microsoft entra, ]

Spice.ai integrates with Microsoft Azure for data federation, AI inference, embeddings, and authentication. This page consolidates Azure-compatible components and links to the relevant configuration guides.

Data Connectors

Data connectors federate SQL queries across Azure data sources without data movement.

Connector	Description	Documentation
Azure Blob Storage / ADLS Gen2	Query Parquet, CSV, and JSON files in Azure Blob Storage (opens in a new tab) or ADLS Gen2 (opens in a new tab) using the `abfs://` scheme.	ABFS Data Connector (opens in a new tab)
Azure SQL Database / SQL Server	Connect to Azure SQL Database (opens in a new tab), Azure SQL Managed Instance (opens in a new tab), and SQL Server VMs.	MSSQL Data Connector (opens in a new tab)
Azure Database for PostgreSQL	Connect to flexible server and single server deployments using the PostgreSQL connector.	PostgreSQL Data Connector (opens in a new tab)
Azure Database for MySQL	Connect to flexible server deployments using the MySQL connector.	MySQL Data Connector (opens in a new tab)
Azure Databricks	Query Databricks tables on Azure using SQL Warehouse or Spark Connect.	Databricks Data Connector (opens in a new tab)
Apache Iceberg (ADLS)	Query Iceberg tables stored in ADLS Gen2 with REST or Unity Catalog metadata.	Iceberg Data Connector (opens in a new tab)
Delta Lake (ADLS)	Query Delta Lake tables stored in ADLS Gen2 or Azure Blob Storage.	Delta Lake Data Connector (opens in a new tab)
Microsoft SharePoint	Index and query documents from SharePoint sites and OneDrive for Business with Microsoft Entra ID authentication.	SharePoint Data Connector (opens in a new tab)
Azure-hosted databases via ODBC	Connect through ODBC drivers for additional Azure-compatible data sources.	ODBC Data Connector (opens in a new tab)

Example: Azure Blob Storage (ABFS)

datasets:
  - from: abfs://container@account.dfs.core.windows.net/path/to/data/
    name: events
    params:
      file_format: parquet
      abfs_account: account
      abfs_use_emulator: 'false'

datasets:
  - from: abfs://container@account.dfs.core.windows.net/path/to/data/
    name: events
    params:
      file_format: parquet
      abfs_account: account
      abfs_use_emulator: 'false'

Example: Azure SQL Database

datasets:
  - from: mssql:dbo.orders
    name: orders
    params:
      mssql_host: my-server.database.windows.net
      mssql_port: 1433
      mssql_database: mydb
      mssql_username: ${ secrets:MSSQL_USER }
      mssql_password: ${ secrets:MSSQL_PASSWORD }

datasets:
  - from: mssql:dbo.orders
    name: orders
    params:
      mssql_host: my-server.database.windows.net
      mssql_port: 1433
      mssql_database: mydb
      mssql_username: ${ secrets:MSSQL_USER }
      mssql_password: ${ secrets:MSSQL_PASSWORD }

The connector authenticates with a SQL Server login and encrypts the connection by default. It does not support Microsoft Entra ID authentication: an Authentication= keyword in mssql_connection_string is ignored, and the connection is attempted as a SQL Server login.

Example: Azure Databricks

datasets:
  - from: databricks:catalog.schema.table
    name: orders
    params:
      mode: spark_connect
      databricks_endpoint: my-workspace.azuredatabricks.net
      databricks_cluster_id: 1234-567890-abcde123
      databricks_token: ${ secrets:DATABRICKS_TOKEN }

datasets:
  - from: databricks:catalog.schema.table
    name: orders
    params:
      mode: spark_connect
      databricks_endpoint: my-workspace.azuredatabricks.net
      databricks_cluster_id: 1234-567890-abcde123
      databricks_token: ${ secrets:DATABRICKS_TOKEN }

Catalog Connectors

Catalog connectors provide schema discovery and unified access to tables in Azure data catalogs.

Connector	Description	Documentation
Databricks Unity Catalog	Discover and query tables governed by Unity Catalog on Azure Databricks. Supports Azure Blob authentication for table data.	Unity Catalog (opens in a new tab)
Databricks Catalog	Connect to Azure Databricks as a catalog source for federated queries.	Databricks Catalog (opens in a new tab)

Example: Unity Catalog with Azure Blob

catalogs:
  - from: unity_catalog:https://my-workspace.azuredatabricks.net/api/2.1/unity-catalog/catalogs/my_catalog
    name: my_catalog
    params:
      unity_catalog_token: ${ secrets:DATABRICKS_TOKEN }
      unity_catalog_azure_storage_account_name: mystorageacct
      unity_catalog_azure_storage_client_id: ${ secrets:AZURE_CLIENT_ID }
      unity_catalog_azure_storage_client_secret: ${ secrets:AZURE_CLIENT_SECRET }

catalogs:
  - from: unity_catalog:https://my-workspace.azuredatabricks.net/api/2.1/unity-catalog/catalogs/my_catalog
    name: my_catalog
    params:
      unity_catalog_token: ${ secrets:DATABRICKS_TOKEN }
      unity_catalog_azure_storage_account_name: mystorageacct
      unity_catalog_azure_storage_client_id: ${ secrets:AZURE_CLIENT_ID }
      unity_catalog_azure_storage_client_secret: ${ secrets:AZURE_CLIENT_SECRET }

AI Models (Azure OpenAI)

Spice integrates with Azure OpenAI Service (opens in a new tab) for chat completion and reasoning models, including GPT-4 family, GPT-5, and o-series models.

Provider	Supported Models	Documentation
Azure OpenAI	GPT-4, GPT-4o, GPT-5, o-series, and other deployments.	Azure OpenAI Models (opens in a new tab)

Example: Azure OpenAI Chat Model

models:
  - from: azure:gpt-4o
    name: gpt
    params:
      endpoint: ${ secrets:SPICE_AZURE_AI_ENDPOINT }
      azure_deployment_name: gpt-4o
      azure_api_version: 2024-08-01-preview
      azure_api_key: ${ secrets:SPICE_AZURE_API_KEY }

models:
  - from: azure:gpt-4o
    name: gpt
    params:
      endpoint: ${ secrets:SPICE_AZURE_AI_ENDPOINT }
      azure_deployment_name: gpt-4o
      azure_api_version: 2024-08-01-preview
      azure_api_key: ${ secrets:SPICE_AZURE_API_KEY }

For Microsoft Entra ID authentication instead of an API key, set azure_entra_token in place of azure_api_key.

Secret Stores

Spice resolves secrets at runtime from configured secret stores (opens in a new tab). For Azure deployments, the azure_keyvault (opens in a new tab) store reads secrets directly from Azure Key Vault (opens in a new tab), so Spicepods can reference connector and model credentials without baking them into environment variables or values.yaml.

Provider	Supported Auth Methods	Documentation
Azure Key Vault	`service_principal`, `managed_identity`, `workload_identity`, `cli`, `default`.	Azure Key Vault Secret Store (opens in a new tab)

Example: Azure Key Vault Secret Store

secrets:
  - from: azure_keyvault:prod-vault
    name: azure
    params:
      auth_method: workload_identity

datasets:
  - from: postgres:public.taxi_trips
    name: taxi_trips
    params:
      pg_host: postgres.example.com
      pg_user: ${azure:postgres_user}
      pg_pass: ${azure:postgres_password}

secrets:
  - from: azure_keyvault:prod-vault
    name: azure
    params:
      auth_method: workload_identity

datasets:
  - from: postgres:public.taxi_trips
    name: taxi_trips
    params:
      pg_host: postgres.example.com
      pg_user: ${azure:postgres_user}
      pg_pass: ${azure:postgres_password}

Logical key names use underscores; the store automatically translates them to Key Vault names like spice-postgres-user (with a fallback to postgres-user). Pair azure_keyvault with AKS workload identity (opens in a new tab) or a Container Apps managed identity (opens in a new tab) so the runtime authenticates without long-lived credentials.

Embeddings (Azure OpenAI)

Generate vector embeddings using Azure OpenAI deployments for semantic search and retrieval-augmented generation (RAG).

Provider	Supported Models	Documentation
Azure OpenAI	`text-embedding-3-small`, `text-embedding-3-large`, `text-embedding-ada-002`.	Azure OpenAI Embeddings (opens in a new tab)

Example: Azure OpenAI Embeddings

embeddings:
  - from: azure:text-embedding-3-small
    name: azure_embed
    params:
      endpoint: ${ secrets:SPICE_AZURE_AI_ENDPOINT }
      azure_deployment_name: text-embedding-3-small
      azure_api_version: 2023-05-15
      azure_api_key: ${ secrets:SPICE_AZURE_API_KEY }

embeddings:
  - from: azure:text-embedding-3-small
    name: azure_embed
    params:
      endpoint: ${ secrets:SPICE_AZURE_AI_ENDPOINT }
      azure_deployment_name: text-embedding-3-small
      azure_api_version: 2023-05-15
      azure_api_key: ${ secrets:SPICE_AZURE_API_KEY }

Refer to the Azure OpenAI Service models (opens in a new tab) for the full list of supported models and regions.

Authentication

Spice does not use the Azure Identity DefaultAzureCredential (opens in a new tab) chain. Each integration resolves Azure credentials on its own:

Integration	Credentials
Azure Blob Storage / ADLS Gen2	Explicit `abfs_` authentication parameters must name at most one method, and client credentials need all three of `abfs_client_id`, `abfs_client_secret`, and `abfs_tenant_id`, or the dataset fails to load. `abfs_` parameters then override `AZURE_*` environment variables, and the first complete credential wins: bearer token, account key, workload identity (`AZURE_FEDERATED_TOKEN_FILE`), service principal secret, SAS token, Azure CLI (only with `abfs_use_cli: true`), then managed identity. Certificate and username/password credentials are not used.
Azure Key Vault	Chosen by `auth_method`. `default` uses a service principal when `client_secret` is set, and otherwise the Azure CLI or Azure Developer CLI login. Managed and workload identity require `auth_method: managed_identity` or `auth_method: workload_identity`.
Azure SQL Database	A SQL Server login in `mssql_connection_string`, or `mssql_username` and `mssql_password`. Microsoft Entra ID authentication is not supported.
Azure OpenAI	`azure_api_key` or `azure_entra_token`.

For the order in detail, see the Authentication (opens in a new tab) section of the Azure deployment guide.

Role Assignments

Each principal must have the appropriate Azure RBAC role for the services it accesses:

Service	Common role(s)
Azure Blob Storage / ADLS Gen2	`Storage Blob Data Reader` or `Storage Blob Data Contributor`
Azure Key Vault	`Key Vault Secrets User` (data plane) or RBAC equivalent
Azure SQL Database	Database permissions granted to the SQL login
Azure OpenAI	`Cognitive Services OpenAI User`
Azure Container Registry	`AcrPull` for image pulls

When a Spicepod connects to multiple Azure services, ensure roles are granted on every resource the runtime touches.

Cookbooks

Azure OpenAI Models (opens in a new tab) — vector search and chat over structured and unstructured data with Azure OpenAI.

spiceai/docs/README.md