Start with dvc remote add to define the remote. Set a name and a valid Azure Blob Storage URL:

To set up authentication or other configuration, set any supported config param with dvc remote modify.

Requires Blob versioning enabled on the storage account and container.

version_aware (true or false) enables cloud versioning features for this remote. This lets you explore the bucket files under the same structure you see in your project directory locally.

This may require the Storage Blob Data Contributor and other roles on the account.

A storage account name (account_name) is always needed. DVC tries to authenticate with its default credential by default. This uses environment variables (usually set during Azure CLI configuration) or data from certain Microsoft applications.

The dvc remote modify --local flag is needed to write sensitive user info to a Git-ignored config file (.dvc/config.local) so that no secrets are leaked through Git. See dvc config.

When using default authentication, you may need to enable some of these exclusion parameters depending on your setup (details):

For custom authentication, you can set the following config params with dvc remote modify --local, use environment variables, or an Azure CLI config file (in that order).

The following params are listed in the order in which they are tried.

A connection string (connection_string) is used if given (recommended) (account_name is ignored since it's included in the connection string).

If tenant_id, client_id, and client_secret are given, Active Directory (AD) service principal auth is used.

A storage account key (account_key) or a shared access signature token (sas_token), in this order.

If allow_anonymous_login is set, then anonymous read access will be tried as a last resort. An account_name is still needed. Only works with public containers.

Some of these env vars can be used instead.

For Azure connection string:

For account name and key/token auth:

For service principal auth (via certificate file):

For simple username/password login:

If no params or env vars are set explicitly, the following values can propagate from an Azure CLI configuration file (typically managed with az config): connection_string, account_name, account_key, sas_token and container_name.

See dvc remote modify for more command usage details.