ShareMaster V2 is in beta, a complete rebuild. See what is new and request access →
Features All features overview
Migration Tools Overview Structure and content OneDrive ↔ SharePoint Content only Structure only Move / Copy Upload from this computer Download to this computer Dropbox to SharePoint Resume and incremental runs
Recycling Bin Overview Browse a site's recycle bin Empty recycle bins in bulk Restore and purge history
Archive Overview Configure the tenant On Demand Archive Restore Archived Files Archive Savings Report Blob Viewer
Optimise Storage Tools Overview Delete all items in a list Delete all files and folders in a library Remove empty folders Remove duplicate files Reduce image sizes Delete sites and subsites
SharePoint Tools Overview Tenant Explorer SharePoint Explorer Easy Settings Fix renamed groups List Explorer Search the Preservation Hold Library
Replace Overview Replace in SharePoint Replace in local files Find password-protected files
Shared Links Overview Report shared links Report unique permissions Remove a person from sharing links Remove shared links Remove unique permissions
Version History Overview Version trimming Version trimming report Reset file version
Reports Overview Inventory report Folder inventory Site and subsite storage Security matrix Teams permissions Pre-migration analysis Compare items Dropbox to Microsoft 365 compare Duplicate file report Empty folder report Image size report Recycle bin report Unused licences Report history
V2 beta Pricing Demos Blog Guides Use cases Compare Tools Alerts FAQ Contact Sign in Start free trial
  1. Home
  2. Documentation
  3. Archive

Step 3: Archive endpoint

The endpoint that serves an archived file, in your tenant

Clicking an archived file sends the click to a small web endpoint, which works out what was clicked, checks the person is allowed it, and hands the file back. That endpoint runs in YOUR Azure subscription. This step creates it.

Makes changes. Creates an Azure Function in your own subscription.
On this page What it does How it runs How it works What you need What it will not do Read next

What it does

  • It is in your tenant because of what a click involves. The endpoint signs the person who clicked in to Microsoft and reads the file as them. An endpoint hosted by ShareMaster would be holding sign-ins to your documents on every click, so we do not host one.
  • It is also in your tenant because of what it has to hold. Handing out a download link requires a credential on your storage account, and that credential never leaves your subscription.
  • NO FILE CONTENT PASSES THROUGH SHAREMASTER. The endpoint creates a short-lived link and sends the browser straight to Azure, so the file goes from your storage to the person who asked for it.
  • It uses a managed identity to reach your storage, which means there is no password or secret anywhere, and nothing to rotate or renew.
  • It runs on the Flex Consumption plan: billed per use, so an endpoint nobody uses costs effectively nothing.

How it runs

  1. A hosting plan is created. Consumption, so you pay per use rather than a monthly charge for an idle endpoint.
  2. The endpoint is created. HTTPS only, TLS 1.2 minimum, FTP disabled, with a managed identity of its own.
  3. It is granted access to your archive. Four roles on the storage account: Storage Blob Data Owner and Storage Blob Delegator for the archive, plus Storage Queue Data Contributor and Storage Table Data Contributor for the endpoint's own bookkeeping.
  4. The roles are read back. From Azure's own answer. The step refuses to report success until they are actually in place.

How it works

Before anything is built, the step checks that your account may assign roles on the storage account, because the endpoint's last step needs that, and asks for every permission it will need in one sign-in. It reads what already exists, so an existing endpoint is updated in place, keeping its address and its access, rather than a second one being created.

On a subscription that has never hosted a web app, Azure's web service is registered first. Then, in the storage account's resource group and region, it creates a container in the same storage account to hold the endpoint's code, the pay-per-use hosting plan, and the Function app with its own managed identity. The identity is given its roles on the storage account and, where it can be, the Sites.Selected application permission (a click does not depend on it, because a restore writes as the person who clicked). The endpoint's settings (such as which storage account and which SharePoint tenant it serves) are written, and only then is the code uploaded, from a package that ships inside ShareMaster, using your Azure sign-in. No publishing password or deployment credential is fetched.

The step is not finished when Azure accepts the upload. It waits for the endpoint to answer its own health check, prompting Azure once to pick up the new code if it is slow, and stops early with Azure's own reason if the code was rejected. The roles are read back from Azure, and a role that briefly disappears after it was confirmed is waited for rather than reported missing, because Azure replicates role assignments. Only then is the .shurl file type registered against the endpoint, the click permission from step 1 checked, and the tenant recorded against your ShareMaster account.

When a click arrives, the endpoint asks sharemaster.io whether the tenant's archive is licensed, sending only the tenant id, the action and its version. It remembers an allow for longer than a refusal, and serves the file if no answer comes. Check reads the endpoint, its roles and whether it is serving, and changes nothing.

What you need

  • Contributor on the resource group, to create the endpoint.
  • Owner or User Access Administrator on the storage account, to grant the endpoint access to it. Contributor alone cannot assign a role.
  • The storage account from the previous step. The endpoint is created beside it, in the same resource group and region.

What it will not do

  • THE ROLES ARE NOT OPTIONAL AND NOT IMPLIED. Owner and Contributor are control-plane roles: they let you manage a storage account without reading what is in it. Without Storage Blob Delegator no download link can be signed, and without a data role nothing can be read or written. Miss either and every part of setup reports success while every single click fails.
  • Nothing here expires. The identity has no secret, and role assignments are permanent until someone removes them. What CAN break it is somebody deleting a role assignment or the Archive application - so this step has a Check button that verifies the roles rather than assuming them.

See every feature