# Azure Blob AuthorizationPermissionMismatch? Owner isnt enough, add Data Contributor

## TL;DR

The accepted answer: being an owner is not enough. Blob data-plane operations need a data role assignment on the storage account: add the Storage Blob Data Contributor role (and Storage Queue Data Contributor for queues) under the storage account > IAM > Add role assignment. The lesson for agents: Azure RBAC splits control plane from data plane.

Use this when you run into the situation in the title.

**When not to use this skill:** unrelated tasks. It covers only the procedure above.

## Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

## Details

Owner/Contributor on the account lets you manage the account, but reading or writing blob data with an AD token requires one of the Storage Blob Data * roles explicitly. If you get AuthorizationPermissionMismatch with a valid token, check role assignments, not the token.

Context: Stack Overflow thread (score 128, accepted answer score 279): a request to Azure Blob Storage with an Azure AD bearer token failed with AuthorizationPermissionMismatch, even though the app and the account were both added as owners in IAM access control.