microsoft/graphrag · error · ValueError

AzureBlobStorage requires only one of connection_string or…

Error message

AzureBlobStorage requires only one of connection_string or account_url to be specified, not both.

What it means

AzureBlobStorage.__init__ accepts either connection_string (for key-based auth) or account_url (for token/DefaultAzureCredential auth). Supplying both makes the chosen auth path ambiguous, so the constructor logs and raises ValueError before creating the client.

Solutions

Remove or unset one of the two credentials (usually drop connection_string when moving to DefaultAzureCredential)
Audit .env / CI secrets for both variables being populated
Default the unused parameter to None explicitly at the call site

Example fix

# before
storage = AzureBlobStorage(
    container_name='mycontainer',
    connection_string=conn_str,
    account_url='https://mystorage.blob.core.windows.net',
)

# after
storage = AzureBlobStorage(
    container_name='mycontainer',
    account_url='https://mystorage.blob.core.windows.net',  # uses DefaultAzureCredential
)

Defensive patterns

Strategy: validation

Validate before calling

assert not (connection_string and account_url), "pass only one of connection_string / account_url"
if account_url:
    connection_string = None

Type guard

null

Try / catch

try:
    s = AzureBlobStorage(container_name=c, connection_string=cs, account_url=url)
except ValueError as e:
    if 'not both' in str(e):
        s = AzureBlobStorage(container_name=c, account_url=url)  # prefer managed identity
    else:
        raise

Prevention

In settings classes, make connection_string and account_url mutually exclusive (validate on load)
Clear unused credential env vars when switching auth modes

When it happens

Trigger: Instantiating AzureBlobStorage(container_name=..., connection_string=..., account_url=...) with both values non-None, often because settings loaders pass every non-empty env var through.

Common situations: A .env / settings object where both GRAPHRAG_STORAGE_CONNECTION_STRING and a storage account URL variable are set (e.g. leftover from switching from key auth to managed identity), or a generic kwargs-from-config constructor.

Related errors

AI-assisted analysis of microsoft/graphrag@f40e9a26ce (2026-08-27). Data as JSON: /api/errors/4f8b055f7ee35629. Report an issue: GitHub.

Appendix: source

Thrown at packages/graphrag-storage/graphrag_storage/azure_blob_storage.py:47

    _encoding: str
    _account_url: str | None
    _blob_service_client: BlobServiceClient
    _storage_account_name: str | None

    def __init__(
        self,
        container_name: str,
        account_url: str | None = None,
        connection_string: str | None = None,
        base_dir: str | None = None,
        encoding: str = "utf-8",
        **kwargs: Any,
    ) -> None:
        """Create a new BlobStorage instance."""
        if connection_string is not None and account_url is not None:
            msg = "AzureBlobStorage requires only one of connection_string or account_url to be specified, not both."
            logger.error(msg)
            raise ValueError(msg)

        _validate_blob_container_name(container_name)

        logger.info(
            "Creating blob storage at [%s] and base_dir [%s]",
            container_name,
            base_dir,
        )
        if connection_string:
            self._blob_service_client = BlobServiceClient.from_connection_string(
                connection_string
            )
        elif account_url:
            self._blob_service_client = BlobServiceClient(
                account_url=account_url,
                credential=DefaultAzureCredential(),
            )
        else:

View on GitHub (pinned to f40e9a26ce)