Governance
BlobBridge blends Azure storage with SharePoint. That means governance needs to span both clouds. This blueprint packages the minimum viable control set we use with enterprise customers so security, compliance and SharePoint admins stay aligned.
Governance goals
Successful programmes hit three objectives:
- Clarity: Everyone knows who owns storage, SAS tokens, web-part configuration and incident response.
- Evidence: Auditors can trace activities (uploads, rotations, approvals) to people and tickets.
- Agility: Controls scale as you add containers and sites without weekly CAB meetings.
Role design
| Role | Azure Responsibility | SharePoint Responsibility |
|---|---|---|
| Storage Platform Team | Own the storage account, lifecycle policies and grant Storage Blob Data Owner role. | Approve BlobBridge pages and enforce site naming/metadata conventions. |
| BlobBridge Operator | Manage SAS rotation automation, Key Vault secrets and monitoring. | Configure web-part settings, licence locations and CORS testing pages. |
| Information Security | Reviews RBAC assignments, approves conditional access and private endpoint use. | Verifies that document retention and sharing policies are respected. |
Control checklist
- RBAC — enforce least privilege by granting the Storage Blob Data Owner role only to automation identities and break-glass admins.
- SAS token policy — rotate every 45 days, scope to containers, log to a central change register, and store in Key Vault.
- CORS approval — document approved origins (usually
https://*.sharepoint.com) and methods (GET/POST/PUT/DELETE). - Configuration review — capture screenshots of BlobBridge settings (Storage URL, container, SAS, licence path) in the change ticket.
- Incident process — define how to revoke tokens, revert to previous versions and notify data owners within four hours.
Auditing and monitoring
Feed signal to the teams that care:
- Azure Monitor alerts when SAS rotation automation fails or Key Vault secret versions stop incrementing.
- Storage logging pushes read/write metrics into Log Analytics or Sentinel for anomaly detection.
- SharePoint Usage reports confirm BlobBridge traffic aligns with expectations (no sudden spikes on sensitive sites).
Update your runbook with the new documentation steps covering Storage account key access, RBAC validation, container creation and SAS configuration.
Change management
Keep processes lightweight but structured:
- Standard change template referencing this blueprint so approvers see the exact controls satisfied.
- Two-person review for production rotations: storage admin generates SAS, SharePoint admin validates the page.
- Quarterly tabletop exercise to rehearse SAS revocation and user communication.
Next steps
Pair this governance blueprint with the deployment checklist and the new SAS automation article to deliver a predictable, well-controlled BlobBridge service. Your security team gets evidence, your admins get clarity, and your users keep the SharePoint experience they love.