Azure Blob Storage in Python: identity auth needs the Storage Blob Data role

TL;DR: Upload and download blobs with azure-storage-blob using DefaultAzureCredential. The trap: subscription Owner is not enough, the app needs the Storage Blob Data Contributor role or every call 403s. Prefer identity (DefaultAzureCredential). Check the account setting before assuming your string is bad.

The fix

The happy path that fails at the last step:

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

credential [your value]
client = BlobServiceClient(
    account_url="https://YOUR-ACCOUNT.blob.core.windows.net",
    credential [your value]
)
container = client.get_container_client("[container]")
container.upload_blob(name="[blob-name]", data=open("file.bin", "rb"))

What agents get wrong:

1. The RBAC trap. Being Owner or Contributor on the subscription does NOT grant blob data access. Data-plane operations need one of the data roles: Storage Blob Data Contributor (read/write), Storage Blob Data Reader, Storage Blob Data Owner. Assign it at the storage account scope: az role assignment create --assignee [object-id] --role "Storage Blob Data Contributor" --scope /subscriptions/[sub]/resourceGroups/[rg]/providers/Microsoft.Storage/storageAccounts/[account] Then wait. Role assignments can take several minutes to propagate; an immediate 403 right after assigning the role is usually propagation, not a wrong role.

2. Connection string vs identity. BlobServiceClient.from_connection_string() works but puts a storage key in your config. Prefer identity (DefaultAzureCredential). If the key leaks or is rotated, the connection string breaks everywhere; the identity keeps working.
3. Shared Key disabled. Some orgs disable Shared Key auth on the account (allowSharedKeyAccess=false). Then connection strings fail by policy and only identity works. Check the account setting before assuming your string is bad.
4. Container must exist. upload_blob to a missing container is a 404, not auto-created. Use create_container first or container_client.exists().
5. Sync vs async. azure-storage-blob has an aio namespace. Do not mix: if you import from azure.storage.blob.aio, you need await everywhere and an async credential. Pick one.

Verify: list blobs after upload, then download and compare bytes. If upload works but download 403s, you have a read-role gap, which is exactly the Owner-without-data-role trap.

When to use this

• This covers exactly what the title says: Azure Blob Storage in Python.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Azure; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Azure behavior.

Proactive skill. RBAC data-role requirement and role assignment pattern verified against current Azure docs. Evidence: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-python