apache · jonkeane · Jul 13, 2026 · Mar 3, 2026 · Mar 5, 2026 · Mar 5, 2026
@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \

@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \

@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \

@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \

@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \

@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \

@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \

@@ -122,6 +122,7 @@ build() {
  -DARROW_PACKAGE_PREFIX="${MINGW_PREFIX}" \
  -DARROW_PARQUET=ON \
  -DARROW_S3=ON \
+ -DARROW_AZURE=OFF \
  -DARROW_SNAPPY_USE_SHARED=OFF \
  -DARROW_USE_GLOG=OFF \
  -DARROW_UTF8PROC_USE_SHARED=OFF \

@@ -35,20 +35,22 @@ else
  apt-get update
 fi
 
-# Install curl, OpenSSL, and libuv
+# Install curl, OpenSSL, libuv, and libxml2
 # - curl/OpenSSL: technically only needed for S3/GCS support, but
 # installing the R curl package fails without it
 # - libpng: required by the png R package
 # - libuv: required by the fs R package (no longer bundles libuv by default)
+# - libxml2: the bundled Azure C++ SDK links against libxml2, so the final
+# link of arrow.so needs it (even when installing a prebuilt libarrow binary)
 case "$PACKAGE_MANAGER" in
  apt-get)
- apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev
+ apt-get install -y libcurl4-openssl-dev libpng-dev libssl-dev libuv1-dev libxml2-dev
  ;;
  apk)
- $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev
+ $PACKAGE_MANAGER add curl-dev openssl-dev libuv-dev libxml2-dev
  ;;
  *)
- $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel
+ $PACKAGE_MANAGER install -y libcurl-devel openssl-devel libuv-devel libxml2-devel
  ;;
 esac
 

@@ -76,12 +76,14 @@ jobs:
  run: |
  brew install sccache ninja
  brew install openssl@3.0
+ brew install libxml2
  - name: Build libarrow
  shell: bash
  env:
  {{ macros.github_set_sccache_envvars()|indent(8) }}
  MACOSX_DEPLOYMENT_TARGET: "11.6"
  ARROW_GCS: ON
+ ARROW_AZURE: ON
  ARROW_DEPENDENCY_SOURCE: BUNDLED
  CMAKE_GENERATOR: Ninja
  LIBARROW_MINIMAL: false

@@ -28,7 +28,8 @@ URL: https://github.com/apache/arrow/, https://arrow.apache.org/docs/r/
 BugReports: https://github.com/apache/arrow/issues
 Encoding: UTF-8
 Language: en-US
-SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl (optional);
+SystemRequirements: C++20; for AWS S3 support on Linux, libcurl and openssl, and
+ libxml2 for Azure (optional);
  cmake >= 3.26 (build-time only, and only for full source build)
 Biarch: true
 Imports:

@@ -183,6 +183,7 @@ S3method(vec_ptype_full,arrow_fixed_size_list)
 S3method(vec_ptype_full,arrow_large_list)
 S3method(vec_ptype_full,arrow_list)
 export(Array)
+export(AzureFileSystem)
 export(Buffer)
 export(BufferOutputStream)
 export(BufferReader)
@@ -282,6 +283,7 @@ export(arrow_available)
 export(arrow_info)
 export(arrow_table)
 export(arrow_with_acero)
+export(arrow_with_azure)
 export(arrow_with_dataset)
 export(arrow_with_gcs)
 export(arrow_with_json)
@@ -295,6 +297,7 @@ export(as_data_type)
 export(as_record_batch)
 export(as_record_batch_reader)
 export(as_schema)
+export(az_container)
 export(binary)
 export(bool)
 export(boolean)

@@ -46,6 +46,7 @@ arrow_info <- function() {
  json = arrow_with_json(),
  s3 = arrow_with_s3(),
  gcs = arrow_with_gcs(),
+ azure = arrow_with_azure(),
  utf8proc = "utf8_upper" %in% compute_funcs,
  re2 = "replace_substring_regex" %in% compute_funcs,
  vapply(tolower(names(CompressionType)[-1]), codec_is_available, logical(1))
@@ -128,6 +129,15 @@ arrow_with_gcs <- function() {
  })
 }
 
+#' @rdname arrow_info
+#' @export
+arrow_with_azure <- function() {
+ tryCatch(.Call(`_azure_available`), error = function(e) {
+ return(FALSE)
+ })
+}
+
+
 #' @rdname arrow_info
 #' @export
 arrow_with_json <- function() {

@@ -189,6 +189,31 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' - `default_metadata`: default metadata to write in new objects.
 #' - `project_id`: the project to use for creating buckets.
 #'
+#' `AzureFileSystem$create()` takes following required argument:
+#'
+#' - `account_name`: Azure Blob Storage account name.
+#'
+#' `AzureFileSystem$create()` takes following optional arguments:
+#'
+#' - `account_key`: Account key of the storage account. Cannot be used with
+#' `sas_token`.
+#' - `blob_storage_authority`: Hostname of the blob service, defaulting to
+#' `"blob.core.windows.net"`.
+#' - `blob_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `client_id`: The client/application ID for Azure Active Directory
+#' authentication. If used with `client_secret` and `tenant_id` then it is the
+#' application ID for a registered Azure AD application. Otherwise, it is the
+#' client ID of a user-assigned managed identity.
+#' - `client_secret`: Client secret for Azure Active Directory authentication.
+#' Must be provided with both `client_id` and `tenant_id`.
+#' - `dfs_storage_authority`: Hostname of the data lake (gen 2) service,
+#' defaulting to `"dfs.core.windows.net"`.
+#' - `dfs_storage_scheme`: Either `"http"` or `"https"` (the default).
+#' - `sas_token`: Shared access signature (SAS) token for the storage account.
+#' Cannot be used with `account key`.
+#' - `tenant_id`: Tenant ID for Azure Active Directory authentication. Must
+#' be provided with both `client_id` and `client_secret`.
+#'
 #' @section Methods:
 #'
 #' - `path(x)`: Create a `SubTreeFileSystem` from the current `FileSystem`
@@ -253,6 +278,10 @@ FileSelector$create <- function(base_dir, allow_not_found = FALSE, recursive = F
 #' (the default), 'ERROR', 'WARN', 'INFO', 'DEBUG' (recommended), 'TRACE', and
 #' 'OFF'.
 #'
+#' On `AzureFileSystem`, passing no arguments for authentication uses the
+#' `AzureDefaultCredential` for authentication, so that several authentication
+#' types are tried until one succeeds.
+#'
 #' @usage NULL
 #' @format NULL
 #' @docType class
@@ -645,6 +674,95 @@ GcsFileSystem$create <- function(anonymous = FALSE, retry_limit_seconds = 15, ..
  fs___GcsFileSystem__Make(anonymous, options)
 }
 
+#' @usage NULL
+#' @format NULL
+#' @rdname FileSystem
+#' @importFrom utils modifyList
+#' @export
+AzureFileSystem <- R6Class(
+ "AzureFileSystem",
+ inherit = FileSystem
+)
+
+AzureFileSystem$create <- function(account_name, ...) {
+ options <- list(...)
+ valid_opts <- c(
+ "account_key",
+ "blob_storage_authority",
+ "blob_storage_scheme",
+ "client_id",
+ "client_secret",
+ "dfs_storage_authority",
+ "dfs_storage_scheme",
+ "sas_token",
+ "tenant_id"
+ )
+
+ invalid_opts <- setdiff(names(options), valid_opts)
+ if (length(invalid_opts)) {
+ stop(
+ "Invalid options for AzureFileSystem: ",
+ oxford_paste(invalid_opts),
+ call. = FALSE
+ )
+ }
+ # The c++ code assumes that the various combinations of authentication methods
+ # have been validated in this function.
+ if (!is.null(options$tenant_id) || !is.null(options$client_id) || !is.null(options$client_secret)) {
+ if (is.null(options$client_id)) {
+ stop(
+ "`client_id` must be given with `tenant_id` and `client_secret`",
+ call. = FALSE
+ )
+ }
+ if (sum(is.null(options$tenant_id), is.null(options$client_secret)) == 1) {
+ stop(
+ "Provide only `client_id` to authenticate with ",
+ "Managed Identity Credential, or provide `client_id`, `tenant_id`, ",
+ "and`client_secret` to authenticate with Client Secret Credential",
+ call. = FALSE
+ )
+ }
+ } else if (!is.null(options$account_key) && !is.null(options$sas_token)) {
+ stop(
+ "Cannot specify both `account_key` and `sas_token`",
+ call. = FALSE
+ )
+ }
+
+ fs___AzureFileSystem__Make(c(account_name = account_name, options))
+}
+
+#' Connect to an Azure Blob Storage container
+#'
+#' `az_conainer` is a convenience function to create an `AzureFileSystem` object
+#' that provides a file system interface for blob storage containers in an Azure
+#' Storage Account.
+#'
+#' @param container_path string Container name or path.
+#' @param ... Additional connection options, passed to `AzureFileSystem$create()`.
+#'
+#' @return A `SubTreeFileSystem` containing an `AzureFileSystem` and the container's
+#' relative path. Note that this function's success does not guarantee that you
+#' are authorized to access the container's contents.
+#' @examplesIf FALSE
+#' container_fs <- az_container(
+#' container_path = "arrow-datasets",
+#' account_name = azurite_account_name,
+#' account_key = azurite_account_key,
+#' blob_storage_authority = azurite_blob_storage_authority,
+#' blob_storage_scheme = azurite_blob_storage_scheme
+#' )
+#' @export
+az_container <- function(container_path, ...) {
+ assert_that(is.string(container_path))
+ args <- list2(...)
+
+ fs <- exec(AzureFileSystem$create, !!!args)
+
+ SubTreeFileSystem$create(container_path, fs)
+}
+
 #' @usage NULL
 #' @format NULL
 #' @rdname FileSystem

@@ -261,10 +261,11 @@ reference:
 
 - title: File systems
  desc: >
- Functions for working with files on S3and GCS
+ Functions for working with files on S3, GCS, and Azure
  contents:
  - s3_bucket
  - gs_bucket
+ - az_container
  - copy_files
 
 - title: Flight

@@ -359,10 +359,14 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ if arrow_built_with ARROW_AZURE; then
+ PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
- if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3; then
+ if arrow_built_with ARROW_GCS || arrow_built_with ARROW_S3 || arrow_built_with ARROW_AZURE; then
  # If pkg-config is available it will handle this for us automatically
  SSL_LIBS_WITHOUT_PC="-lcurl -lssl -lcrypto"
  fi

@@ -67,6 +67,7 @@ function configure_binaries() {
  # pkg-config --libs libcurl
  GCS_LIBS="-lcurl -lnormaliz -lssh2 -lgdi32 -lssl -lcrypto -lcrypt32 -lwldap32 \
  -lz -lws2_32 -lnghttp2 -ldbghelp"
+ # AZURE_LIBS="-lcurl -lssl -lxml2"
 
  # Set the right flags to point to and enable arrow/parquet
  if [ -d "windows/r-libarrow-windows-x86_64-$VERSION" ]; then
@@ -94,8 +95,8 @@ function configure_binaries() {
  # S3, GCS, and re2 support only for Rtools40 (i.e. R >= 4.0)
  "${R_HOME}/bin${R_ARCH_BIN}/Rscript.exe" -e 'R.version$major >= 4' | grep TRUE >/dev/null 2>&1
  if [ $? -eq 0 ]; then
- PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS"
- PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}"
+ PKG_CFLAGS="${PKG_CFLAGS} -DARROW_R_WITH_S3 -DARROW_R_WITH_GCS" # -DARROW_R_WITH_AZURE
+ PKG_LIBS="${PKG_LIBS} -lre2 ${AWS_LIBS} ${GCS_LIBS}" # ${AZURE_LIBS}
  else
  # It seems that order matters
  PKG_LIBS="${PKG_LIBS} -lws2_32"
@@ -187,6 +188,10 @@ add_feature_flags () {
  if arrow_built_with ARROW_S3; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_S3"
  fi
+ # if arrow_built_with ARROW_AZURE; then
+ # PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_AZURE"
+ # PKG_LIBS_FEATURES="$PKG_LIBS_FEATURES -lxml2"
+ # fi
  if arrow_built_with ARROW_GCS; then
  PKG_CFLAGS_FEATURES="$PKG_CFLAGS_FEATURES -DARROW_R_WITH_GCS"
  fi
@@ -292,6 +297,10 @@ function configure_dev() {
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_GCS"
  fi
 
+ # if [ $(cmake_option ARROW_AZURE) -eq 1 ]; then
+ # PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_AZURE"
+ # fi
+
  if [ $(cmake_option ARROW_JSON) -eq 1 ]; then
  PKG_CFLAGS="$PKG_CFLAGS -DARROW_R_WITH_JSON"
  fi

@@ -30,7 +30,7 @@
 # Ensure that all machines are sorting the same way
 invisible(Sys.setlocale("LC_COLLATE", "C"))
 
-features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "json")
+features <- c("acero", "dataset", "substrait", "parquet", "s3", "gcs", "azure", "json")
 
 suppressPackageStartupMessages({
  library(decor)

@@ -84,6 +84,7 @@ ${CMAKE_WRAPPER} ${CMAKE} -DARROW_BOOST_USE_SHARED=OFF \
  -Dlz4_SOURCE=${lz4_SOURCE:-} \
  -DARROW_FILESYSTEM=ON \
  -DARROW_GCS=${ARROW_GCS:-OFF} \
+ -DARROW_AZURE=${ARROW_AZURE:-$ARROW_DEFAULT_PARAM} \
  -DARROW_JEMALLOC=${ARROW_JEMALLOC:-$ARROW_DEFAULT_PARAM} \
  -DARROW_MIMALLOC=${ARROW_MIMALLOC:-ON} \
  -DARROW_JSON=${ARROW_JSON:-ON} \