Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →microsoft-foundry/workspace-mount
Mount a user-owned Azure Blob container as a plain folder (the "project drive") inside a managed harness sandbox, using the agent's managed identity (MSI) — no account key or SAS. Use at the start of every session before reading or writing shared project files, so multiple agents and multiple sessions all see the same durable workspace. Also flushes/unmounts so writes become durable for the next session. Requires the agent identity to hold 'Storage Blob Data Contributor' on the container or acco
Passed 18 of 19 test cases with the skill, and 7 of 19 without it.
and 10 more in the full report
12 fixed6 passed either way0 still failing1 broke3 errored
Tokens, turns and time describe resource use, not a dollar price.
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are configuring the sandbox drive mount script for an Azure environment that uses a user-assigned managed identity rather than a system-assigned one. Which environment variable must be set to specify the user-assigned identity's client ID?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies `AZURE_STORAGE_IDENTITY_CLIENT_ID` as the required environment variable. | Missed | Passed |
The instructions your model reads when the skill loads.
Give the agent a shared project drive: mount a blob container the user owns as an
ordinary folder inside the harness sandbox. Once mounted, reading and writing project files
(sources.csv, findings/*.md, report.md, status.md, …) is plain filesystem I/O — no
storage SDK, no keys, no SAS. Authentication uses the agent's managed identity via
blobfuse2's MSI auth, so no credential ever enters the command line or the model's context.
The same container mounted from any session or any agent is the same drive — this is what lets Scout and Quill hand work off to each other across days and separate chats.
This wraps
blobfuse2(a FUSE client for Azure Blob). It is an interim pattern for giving hosted agents a durable, shareable workspace until native blob-volume mounting is available.
/dev/fuse and mount FUSE.ba92f5b4-2d11-453d-a403-e96b0029c9fe) on the target container or account.
A mount that succeeds but shows an empty/again-empty folder, or a 403 in blobfuse2 logs,
means the role is missing or still propagating (allow 5–10 min).packages.microsoft.com (only on first run, to install blobfuse2 if the
base image doesn't ship it).| Variable | Required | Default | Meaning |
|---|---|---|---|
AZURE_STORAGE_ACCOUNT | ✅ | — | Storage account name (no .blob.core.windows.net). |
WORKSPACE_CONTAINER | ✅ | — | Blob container to mount as the project drive. |
MOUNT_PATH | /workspace/project | Where the drive appears in the sandbox. | |
TMP_PATH | /tmp/blobfuse2 | blobfuse2 local file cache. | |
AZURE_STORAGE_IDENTITY_CLIENT_ID | — | Client ID of a user-assigned MI, if the identity isn't system-assigned. |
test cases passed, vs 7 / 19 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.