Create a Service Principal

Create a Microsoft Entra application and service principal for the Ranger ABFS plugin.

The service principal acts as the administrator identity that Ranger uses to read and update POSIX ACLs on Azure Blob Storage resources.

You can create the service principal by using the Azure portal or Azure CLI.

The following example uses Azure CLI:

APP_ID=$(az ad app create \ --display-name "ranger-abfs-acl-manager" \ --query appId \ -o tsv) SP_OBJECT_ID=$(az ad sp create \ --id "$APP_ID" \ --query id \ -o tsv) az ad app credential reset \ --id "$APP_ID" \ --display-name "ranger-abfs-client-secret"

Save the generated client secret value when you create the secret. Microsoft Entra displays the value only when the secret is created.

Assign the Storage Blob Data Owner role to the service principal:

STORAGE_SCOPE=$(az storage account show \ --name <storage-account> \ --resource-group <resource-group> \ --query id \ -o tsv) az role assignment create \ --assignee-object-id "$SP_OBJECT_ID" \ --assignee-principal-type ServicePrincipal \ --role "Storage Blob Data Owner" \ --scope "$STORAGE_SCOPE"

Role assignments can take several minutes to propagate.

The Storage Blob Data Owner role provides superuser-level access to the data plane and bypasses ACL checks. Therefore, do not use the Ranger ABFS plugin service principal to test access-denied scenarios. Use a separate principal that does not have an RBAC data role.

Last updated on Aug 31, 2026

Was this page helpful?