Azure Blob Storage in Python: identity auth needs the Storage Blob Data role

The happy path that fails at the last step:

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

credential = DefaultAzureCredential()
client = BlobServiceClient(
    account_url="https://YOUR-ACCOUNT.blob.core.windows.net",
    credential=credential,
)
container = client.get_container_client("[container]")
container.upload_blob(name="[blob-name]", data=open("file.bin", "rb"))

What agents get wrong:

1. The RBAC trap. Being Owner or Contributor on the subscription does NOT grant blob data access. Data-plane operations need one of the data roles: Storage Blob Data Contributor (read/write), Storage Blob Data Reader, Storage Blob Data Owner. Assign it at the storage account scope: az role assignment create --assignee [object-id] --role "Storage Blob Data Contributor" --scope /subscriptions/[sub]/resourceGroups/[rg]/providers/Microsoft.Storage/storageAccounts/[account] Then wait. Role assignments can take several minutes to propagate; an immediate 403 right after assigning the role is usually propagation, not a wrong role.

2. Connection string vs identity. BlobServiceClient.from_connection_string() works but puts a storage key in your config. Prefer identity (DefaultAzureCredential). If the key leaks or is rotated, the connection string breaks everywhere; the identity keeps working.
3. Shared Key disabled. Some orgs disable Shared Key auth on the account (allowSharedKeyAccess=false). Then connection strings fail by policy and only identity works. Check the account setting before assuming your string is bad.
4. Container must exist. upload_blob to a missing container is a 404, not auto-created. Use create_container first or container_client.exists().
5. Sync vs async. azure-storage-blob has an aio namespace. Do not mix: if you import from azure.storage.blob.aio, you need await everywhere and an async credential. Pick one.

Verify: list blobs after upload, then download and compare bytes. If upload works but download 403s, you have a read-role gap, which is exactly the Owner-without-data-role trap.

Proactive skill. RBAC data-role requirement and role assignment pattern verified against current Azure docs. Evidence: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-python