Diagnose: AuthenticationFailed: signature did not match (Storage Shared Key)

SYMPTOM AuthenticationFailed: signature did not match (Storage Shared Key)

CAUSE The Shared Key signature is wrong: rotated/wrong key, wrong key slot (key1 vs key2), VM clock skew beyond ~15 minutes, or Azurite dev-key vs real-key mixup. With SDKs it is never the string-to-sign.

CONFIRM IT CONFIRM: every request fails identically (clock skew or wrong key); only some fail (key rotated mid-run). az storage account keys list and compare which slot the connection string uses. Check VM clock against NTP.

FIX FIX: regenerate the connection string from the current key; resync the clock (w32tm /resync or NTP); point Azurite configs at the well-known dev key and real accounts at real keys. Long term: move to identity auth and delete the key dependency.

VERIFY VERIFY: a simple az storage blob list --auth-mode key (or SDK list) succeeds; then the app's calls succeed.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/rest/api/storagerp/common-error-messages