From 257d9e8c9beccc115db818596e74e2a69432f9b9 Mon Sep 17 00:00:00 2001 From: Zachary Blasczyk Date: Mon, 27 Jul 2026 14:43:27 -0500 Subject: [PATCH 1/9] docs(byob): explain Azure authentication options --- .../data-security/secure-storage-connector.mdx | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/platform/hosting/data-security/secure-storage-connector.mdx b/platform/hosting/data-security/secure-storage-connector.mdx index a7d14bd9fe..66cdfea681 100644 --- a/platform/hosting/data-security/secure-storage-connector.mdx +++ b/platform/hosting/data-security/secure-storage-connector.mdx @@ -381,7 +381,12 @@ For details, see [Create a blob storage container](https://learn.microsoft.com/e If data in your bucket expires because of an [object lifecycle management policy](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal), you may lose the ability to read the history of some runs. -1. Generate a storage account access key and make a note of its name and the storage account name. If you use [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud), share the storage account name and access key with your W&B team using a secure sharing mechanism. +1. Choose an authentication method: + + - **Storage account key**: Generate a storage account access key and record the key and storage account name. For Dedicated Cloud, share these values with your W&B team through a secure sharing mechanism. + - **Workload identity**: Don't generate or share a storage account key. The W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures the identity federation for the deployment. + + Existing instance-level BYOB configurations that use a storage account key continue to work and don't require migration. **Team level BYOB**: @@ -478,10 +483,12 @@ For **Self-Managed**, you can configure instance level BYOB using the W&B App: 1. Log in to W&B as a user with the `admin` role. 1. Click the user icon at the top, then click **System Console**. 1. Navigate to **Settings** > **System Connections**. -1. In the **Bucket Storage** section, ensure the identity in the **Identity** field has access to the new bucket. -1. Select the **Provider**. -1. Enter the **Bucket Name**. +1. In the **Bucket Storage** section, select **Azure** as the **Provider**. +1. Enter the storage account name in **Bucket Name**. 1. Optional: Enter the **Path** to use in the new bucket. +1. In **Authentication**, select one of the following options: + - **Storage account key**: Enter the storage account access key. Use this option to retain an existing key-based BYOB configuration. + - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. If this option is unavailable, configure `global.azureStorageIdentity` for the deployment first. 1. Click **Save**. After you save, W&B uses the configured bucket as the default storage destination for new artifacts and run files at the instance level. From 04662b529e764e763e92202368a29fb00ed876db Mon Sep 17 00:00:00 2001 From: Zachary Blasczyk Date: Wed, 29 Jul 2026 18:28:05 -0500 Subject: [PATCH 2/9] docs(byob): clarify shared Azure identity rollout --- platform/hosting/data-security/secure-storage-connector.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/platform/hosting/data-security/secure-storage-connector.mdx b/platform/hosting/data-security/secure-storage-connector.mdx index 66cdfea681..a7edf64769 100644 --- a/platform/hosting/data-security/secure-storage-connector.mdx +++ b/platform/hosting/data-security/secure-storage-connector.mdx @@ -384,9 +384,9 @@ For details, see [Create a blob storage container](https://learn.microsoft.com/e 1. Choose an authentication method: - **Storage account key**: Generate a storage account access key and record the key and storage account name. For Dedicated Cloud, share these values with your W&B team through a secure sharing mechanism. - - **Workload identity**: Don't generate or share a storage account key. The W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures the identity federation for the deployment. + - **Workload identity**: Don't generate or share a storage account key. The W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide `wandb-bucket-access` Kubernetes ServiceAccount. - Existing instance-level BYOB configurations that use a storage account key continue to work and don't require migration. + Workload identity is an opt-in migration. Existing instance-level BYOB configurations continue to use their storage account key until you change their authentication method. **Team level BYOB**: @@ -488,7 +488,7 @@ For **Self-Managed**, you can configure instance level BYOB using the W&B App: 1. Optional: Enter the **Path** to use in the new bucket. 1. In **Authentication**, select one of the following options: - **Storage account key**: Enter the storage account access key. Use this option to retain an existing key-based BYOB configuration. - - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. If this option is unavailable, configure `global.azureStorageIdentity` for the deployment first. + - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. This option requires the `operator-wandb` chart version 0.44.0 or later and a configured `global.azureStorageIdentity`. 1. Click **Save**. After you save, W&B uses the configured bucket as the default storage destination for new artifacts and run files at the instance level. From b46aa2371823ffcc728589232e7d11e6cc4b6f5c Mon Sep 17 00:00:00 2001 From: Zachary Blasczyk <77289967+zacharyblasczyk@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:20:22 -0500 Subject: [PATCH 3/9] Update platform/hosting/data-security/secure-storage-connector.mdx Co-authored-by: Matt Linville --- platform/hosting/data-security/secure-storage-connector.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/hosting/data-security/secure-storage-connector.mdx b/platform/hosting/data-security/secure-storage-connector.mdx index a7edf64769..417c9da355 100644 --- a/platform/hosting/data-security/secure-storage-connector.mdx +++ b/platform/hosting/data-security/secure-storage-connector.mdx @@ -383,7 +383,7 @@ For details, see [Create a blob storage container](https://learn.microsoft.com/e 1. Choose an authentication method: - - **Storage account key**: Generate a storage account access key and record the key and storage account name. For Dedicated Cloud, share these values with your W&B team through a secure sharing mechanism. + - **Storage account key**: Generate a storage account access key and record the key and storage account name. For organizations on Dedicated Cloud, share these values with your W&B account team using a secure sharing mechanism. - **Workload identity**: Don't generate or share a storage account key. The W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide `wandb-bucket-access` Kubernetes ServiceAccount. Workload identity is an opt-in migration. Existing instance-level BYOB configurations continue to use their storage account key until you change their authentication method. From 62bcad201bbb8d8e4811f06c54c74225ff8a7c7a Mon Sep 17 00:00:00 2001 From: Zachary Blasczyk <77289967+zacharyblasczyk@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:20:33 -0500 Subject: [PATCH 4/9] Update platform/hosting/data-security/secure-storage-connector.mdx Co-authored-by: Matt Linville --- platform/hosting/data-security/secure-storage-connector.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/hosting/data-security/secure-storage-connector.mdx b/platform/hosting/data-security/secure-storage-connector.mdx index 417c9da355..0561042ff4 100644 --- a/platform/hosting/data-security/secure-storage-connector.mdx +++ b/platform/hosting/data-security/secure-storage-connector.mdx @@ -384,7 +384,7 @@ For details, see [Create a blob storage container](https://learn.microsoft.com/e 1. Choose an authentication method: - **Storage account key**: Generate a storage account access key and record the key and storage account name. For organizations on Dedicated Cloud, share these values with your W&B account team using a secure sharing mechanism. - - **Workload identity**: Don't generate or share a storage account key. The W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide `wandb-bucket-access` Kubernetes ServiceAccount. + - **Workload identity**: Don't generate or share a storage account key. Instead, the W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide Kubernetes service account named `wandb-bucket-access`. For Self-Managed deployments, requires Operator Helm chart [v0.44.4+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.4). Workload identity is an opt-in migration. Existing instance-level BYOB configurations continue to use their storage account key until you change their authentication method. From 3c86c40e0aa045d0427c64efdfb9eafe5325c1f4 Mon Sep 17 00:00:00 2001 From: Zachary Blasczyk <77289967+zacharyblasczyk@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:20:41 -0500 Subject: [PATCH 5/9] Update platform/hosting/data-security/secure-storage-connector.mdx Co-authored-by: Matt Linville --- platform/hosting/data-security/secure-storage-connector.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/hosting/data-security/secure-storage-connector.mdx b/platform/hosting/data-security/secure-storage-connector.mdx index 0561042ff4..85de1592dc 100644 --- a/platform/hosting/data-security/secure-storage-connector.mdx +++ b/platform/hosting/data-security/secure-storage-connector.mdx @@ -488,7 +488,7 @@ For **Self-Managed**, you can configure instance level BYOB using the W&B App: 1. Optional: Enter the **Path** to use in the new bucket. 1. In **Authentication**, select one of the following options: - **Storage account key**: Enter the storage account access key. Use this option to retain an existing key-based BYOB configuration. - - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. This option requires the `operator-wandb` chart version 0.44.0 or later and a configured `global.azureStorageIdentity`. + - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. For Self-Managed deployments, requires Operator Helm chart [v0.44.4+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.4). 1. Click **Save**. After you save, W&B uses the configured bucket as the default storage destination for new artifacts and run files at the instance level. From e9724ba233e918900ab0eefb4566a1c18387a64e Mon Sep 17 00:00:00 2001 From: Matt Linville Date: Wed, 19 Aug 2026 14:50:37 -0700 Subject: [PATCH 6/9] Update Weave BYOB prereqs Updated the prerequisites section to include support for Dedicated Cloud and Self-Managed options. --- snippets/_includes/byob-reference-setup.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/snippets/_includes/byob-reference-setup.mdx b/snippets/_includes/byob-reference-setup.mdx index 3e9b05b62f..d496f7b370 100644 --- a/snippets/_includes/byob-reference-setup.mdx +++ b/snippets/_includes/byob-reference-setup.mdx @@ -24,7 +24,7 @@ Weave only resolves URIs that point at a bucket registered for your team. Suppor ## Prerequisites -- This feature is supported only in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud). +- This feature is supported in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud) and in preview for [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud), and [Self-Managed](https://docs.wandb.ai/platform/hosting/hosting-options/self-managed) v0.84+. - A W&B account and [API key](https://wandb.ai/authorize). - A cloud storage bucket you control (S3 or GCS), containing at least one object. - Organization admin permissions. Adding a reference bucket requires the same permission as creating a team in the organization. From 778d657493efd50faebe69e9a053ed7a37c5f4d8 Mon Sep 17 00:00:00 2001 From: Matt Linville Date: Wed, 19 Aug 2026 14:59:54 -0700 Subject: [PATCH 7/9] Update Weave BYOB in W&B BYOB docs --- snippets/_includes/weave-byob.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/snippets/_includes/weave-byob.mdx b/snippets/_includes/weave-byob.mdx index 6d5855a4dc..a04d1f3328 100644 --- a/snippets/_includes/weave-byob.mdx +++ b/snippets/_includes/weave-byob.mdx @@ -1,3 +1,3 @@ -[The W&B Platform secure storage connector or BYOB](/platform/hosting/data-security/secure-storage-connector) is not available for Weave. - \ No newline at end of file +This page is for the W&B platform secure storage connector or BYOB and does not apply to Weave. To render images and video that live in your own cloud bucket in Weave without importing the bytes into Weave, see the [Weave BYOB reference](/weave/guides/tracking/byob-references#reference-media-in-your-own-bucket-byob-using-weave-op). + From b1d188f5e39138b787953fa0a7271a694d23aa57 Mon Sep 17 00:00:00 2001 From: Matt Linville Date: Wed, 19 Aug 2026 15:15:09 -0700 Subject: [PATCH 8/9] Fix Helm chart version Co-authored-by: Matt Linville --- platform/hosting/data-security/secure-storage-connector.mdx | 4 ++-- snippets/_includes/byob-reference-setup.mdx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/platform/hosting/data-security/secure-storage-connector.mdx b/platform/hosting/data-security/secure-storage-connector.mdx index 85de1592dc..904654fb66 100644 --- a/platform/hosting/data-security/secure-storage-connector.mdx +++ b/platform/hosting/data-security/secure-storage-connector.mdx @@ -384,7 +384,7 @@ For details, see [Create a blob storage container](https://learn.microsoft.com/e 1. Choose an authentication method: - **Storage account key**: Generate a storage account access key and record the key and storage account name. For organizations on Dedicated Cloud, share these values with your W&B account team using a secure sharing mechanism. - - **Workload identity**: Don't generate or share a storage account key. Instead, the W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide Kubernetes service account named `wandb-bucket-access`. For Self-Managed deployments, requires Operator Helm chart [v0.44.4+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.4). + - **Workload identity**: Don't generate or share a storage account key. Instead, the W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide Kubernetes service account named `wandb-bucket-access`. For Self-Managed deployments, requires Operator Helm chart [v0.44.0+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.0). Workload identity is an opt-in migration. Existing instance-level BYOB configurations continue to use their storage account key until you change their authentication method. @@ -488,7 +488,7 @@ For **Self-Managed**, you can configure instance level BYOB using the W&B App: 1. Optional: Enter the **Path** to use in the new bucket. 1. In **Authentication**, select one of the following options: - **Storage account key**: Enter the storage account access key. Use this option to retain an existing key-based BYOB configuration. - - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. For Self-Managed deployments, requires Operator Helm chart [v0.44.4+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.4). + - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. For Self-Managed deployments, requires Operator Helm chart [v0.44.0+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.0). 1. Click **Save**. After you save, W&B uses the configured bucket as the default storage destination for new artifacts and run files at the instance level. diff --git a/snippets/_includes/byob-reference-setup.mdx b/snippets/_includes/byob-reference-setup.mdx index d496f7b370..20290fa935 100644 --- a/snippets/_includes/byob-reference-setup.mdx +++ b/snippets/_includes/byob-reference-setup.mdx @@ -24,7 +24,7 @@ Weave only resolves URIs that point at a bucket registered for your team. Suppor ## Prerequisites -- This feature is supported in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud) and in preview for [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud), and [Self-Managed](https://docs.wandb.ai/platform/hosting/hosting-options/self-managed) v0.84+. +- This feature is supported in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud) and in preview for [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud) and [Self-Managed](https://docs.wandb.ai/platform/hosting/hosting-options/self-managed) v0.84+. - A W&B account and [API key](https://wandb.ai/authorize). - A cloud storage bucket you control (S3 or GCS), containing at least one object. - Organization admin permissions. Adding a reference bucket requires the same permission as creating a team in the organization. From 047bb80c86d7f63eb1fa1ddfd2aaae4f813d05c0 Mon Sep 17 00:00:00 2001 From: Matt Linville Date: Wed, 19 Aug 2026 15:41:36 -0700 Subject: [PATCH 9/9] Update snippets/_includes/byob-reference-setup.mdx --- snippets/_includes/byob-reference-setup.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/snippets/_includes/byob-reference-setup.mdx b/snippets/_includes/byob-reference-setup.mdx index 20290fa935..4f3d4e8fb1 100644 --- a/snippets/_includes/byob-reference-setup.mdx +++ b/snippets/_includes/byob-reference-setup.mdx @@ -24,7 +24,7 @@ Weave only resolves URIs that point at a bucket registered for your team. Suppor ## Prerequisites -- This feature is supported in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud) and in preview for [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud) and [Self-Managed](https://docs.wandb.ai/platform/hosting/hosting-options/self-managed) v0.84+. +- This feature is supported in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud) and in preview for [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud) and [Self-Managed](https://docs.wandb.ai/platform/hosting/hosting-options/self-managed) v0.84.0+. - A W&B account and [API key](https://wandb.ai/authorize). - A cloud storage bucket you control (S3 or GCS), containing at least one object. - Organization admin permissions. Adding a reference bucket requires the same permission as creating a team in the organization.