Governance
BlobBridge blends Azure storage with SharePoint. That means governance needs to span both clouds. This blueprint packages the minimum viable control set we use with enterprise customers so security, compliance and SharePoint admins stay aligned.
Governance goals
Successful programmes hit three objectives:
- Clarity: Everyone knows who owns storage, SAS tokens, web-part configuration and incident response.
- Evidence: Auditors can trace activities (uploads, rotations, approvals) to people and tickets.
- Agility: Controls scale as you add containers and sites without weekly CAB meetings.
Role design
| Role | Azure Responsibility | SharePoint Responsibility |
|---|---|---|
| Storage Platform Team | Own the storage account, lifecycle policies and grant Storage Blob Data Owner role. | Approve BlobBridge pages and enforce site naming/metadata conventions. |
| BlobBridge Operator | Manage customer-owned SAS rotation automation and monitoring. | Configure web-part settings, licence locations and CORS testing pages. |
| Information Security | Reviews SAS permissions, approved origins and storage network controls. | Verifies that document retention and sharing policies are respected. |
Control checklist
- SAS permissions - enforce least privilege by granting only the permissions required for the intended BlobBridge actions.
- SAS token policy - rotate every 45 days, scope to containers, log to a central change register, and update BlobBridge web part configuration through customer-controlled automation or a documented admin process.
- CORS approval - document approved origins (usually
https://*.sharepoint.com) and methods (GET/POST/PUT/DELETE). - Configuration review - capture screenshots of BlobBridge settings (Storage URL, container, SAS, licence path) in the change ticket.
- Incident process - define how to revoke tokens, revert to previous versions and notify data owners within four hours.
Auditing and monitoring
Feed signal to the teams that care:
- Azure Monitor alerts when SAS rotation automation or SharePoint configuration updates fail.
- Storage logging pushes read/write metrics into Log Analytics or Sentinel for anomaly detection.
- SharePoint Usage reports confirm BlobBridge traffic aligns with expectations (no sudden spikes on sensitive sites).
Update your runbook with the new documentation steps covering container creation, CORS and SAS configuration.
Change management
Keep processes lightweight but structured:
- Standard change template referencing this blueprint so approvers see the exact controls satisfied.
- Two-person review for production rotations: storage admin generates SAS, SharePoint admin validates the page.
- Quarterly tabletop exercise to rehearse SAS revocation and user communication.
Next steps
Pair this governance blueprint with the deployment checklist and the new SAS automation article to deliver a predictable, well-controlled BlobBridge service. Your security team gets evidence, your admins get clarity, and your users keep the SharePoint experience they love.