Error text: `AuthenticationFailed: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.`
With SDKs (the common case):
1. **Key rotated.** The connection string holds an old key. Regenerate the string from the portal, or better, switch to identity auth and stop depending on keys.
2. **Wrong key slot.** Storage accounts have key1/key2. The string uses key1, someone rotated key1. Use key2 while you fix, then rotate both on a schedule.
3. **Clock skew.** Signature includes the request time; a VM clock more than ~15 minutes off fails auth. `w32tm /resync` on Windows, NTP check on Linux. This one produces identical errors on every request, which is the tell.
4. **Emulator mismatch.** Azurite uses the well-known dev key. Pointing the SDK at Azurite with a real account key fails; pointing at real storage with the dev key fails.
With hand-rolled REST:
5. **String-to-sign.** Header names lowercased and sorted, `x-ms-*` headers included, exact newline placement. One missing header breaks the signature. Prefer the SDK; hand-rolling Shared Key auth is a bug farm.
Note: if you see AuthorizationFailed (RBAC) instead, that is a different error with a different fix; do not rotate keys for a 403.