Error text: `AuthorizationFailed: The client ... does not have authorization to perform action 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'`.
What it means: Entra ID authenticated you fine, but Azure RBAC denied the action. The action string in the message tells you exactly which permission is missing.
Fix pattern:
1. Read the action in the error. `.../blobs/read` = need Storage Blob Data Reader or better. `.../secrets/getSecret/action` = need Key Vault Secrets User. Map the action to the data role:
- Storage blobs/queues/tables: Storage Blob/Queue/Table Data Contributor (or Reader)
- Key Vault secrets/keys/certs: Key Vault Secrets User / Officer
- Service Bus send/receive: Azure Service Bus Data Sender / Receiver / Owner
- Cosmos DB documents: Cosmos DB Built-in Data Reader / Contributor (a separate role system, assigned via cosmosdb commands)
2. Assign at the narrowest scope that works (the storage account, not the subscription):
`az role assignment create --assignee [object-id] --role "Storage Blob Data Contributor" --scope [resource-id]`
3. Wait 5-10 minutes. Role assignments propagate slowly; an immediate retry 403 is expected, not proof the fix failed.
4. Confirm with the same identity: `az role assignment list --assignee [object-id] --scope [resource-id]`.
What it is NOT: a bad key, a wrong endpoint, or a firewall. Those produce 401/404/timeout, not AuthorizationFailed. Do not rotate keys when you see this error.