Yaolin Ge

Sandvik Coromant · Azure

Sharing recordings without sharing the keys

Central, audited storage for sensor recordings on Azure: Blob Storage and a document database behind least-privilege roles, managed identity and automated delivery.

workstations blob + document db admin analyst reader least-privilege roles audit log

The problem

Recordings lived on individual PCs. Teams could not share them, and nobody could say who had changed what.

What I built

  • Storage: Blob Storage for the recordings and a document database for their metadata, with conflict and overwrite resolution between the cloud copy and each local database, and an idempotent sync from remote to local.
  • Audit log and activity monitor, so every change has an author and a time.
  • Least privilege by design: three custom data-plane roles instead of one broad key, and a self-service tool for assigning them.
  • Identity: Entra ID sign-in with MSAL, and managed identity for the service itself, instead of stored credentials.
  • Delivery: PowerShell and az CLI provisioning, App Service with Easy Auth, Azure DevOps CI/CD, and cost and capacity monitoring through the Azure APIs.

A bug worth remembering

The audit query returned the oldest 200 events rather than the newest, so the activity view quietly showed history instead of what had just happened. Since fixing it, "which end of the list does this page come from?" is one of my standard review questions.