Azure Blob AuthorizationPermissionMismatch? Owner isnt enough, add Data Contributor

Azure Blob AuthorizationPermissionMismatch? Owner isnt enough, add Data Contributor

TL;DR

The accepted answer: being an owner is not enough. Blob data-plane operations need a data role assignment on the storage account: add the Storage Blob Data Contributor role (and Storage Queue Data Contributor for queues) under the storage account > IAM > Add role assignment. The lesson for agents: Azure RBAC splits control plane from data plane.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Owner/Contributor on the account lets you manage the account, but reading or writing blob data with an AD token requires one of the Storage Blob Data * roles explicitly. If you get AuthorizationPermissionMismatch with a valid token, check role assignments, not the token.

Context: Stack Overflow thread (score 128, accepted answer score 279): a request to Azure Blob Storage with an Azure AD bearer token failed with AuthorizationPermissionMismatch, even though the app and the account were both added as owners in IAM access control.

Source: Stack Overflow thread (score 128, accepted answer score 279): a request to Azure Blob Storage with an Azure AD bearer token failed with AuthorizationPermissionMismatch, even though the app and the account were both added as owners in IAM access control.

Verified resolution: The accepted answer: being an owner is not enough. Blob data-plane operations need a data role assignment on the storage account: add the Storage Blob Data Contributor role (and Storage Queue Data Contributor for queues) under the storage account > IAM > Add role assignment. The lesson for agents: Azure RBAC splits control plane from data plane. Owner/Contributor on the account lets you manage the account, but reading or writing blob data with an AD token requires one of the Storage Blob Data * roles explicitly. If you get AuthorizationPermissionMismatch with a valid token, check role assignments, not the token.

Source URL: https://stackoverflow.com/questions/52769758