Error text: `AuthorizationFailed: The client ... does not have authorization to perform action 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'`.

What it means: Entra ID authenticated you fine, but Azure RBAC denied the action. The action string in the message tells you exactly which permission is missing.

Fix pattern:

1. Read the action in the error. `.../blobs/read` = need Storage Blob Data Reader or better. `.../secrets/getSecret/action` = need Key Vault Secrets User. Map the action to the data role:
   - Storage blobs/queues/tables: Storage Blob/Queue/Table Data Contributor (or Reader)
   - Key Vault secrets/keys/certs: Key Vault Secrets User / Officer
   - Service Bus send/receive: Azure Service Bus Data Sender / Receiver / Owner
   - Cosmos DB documents: Cosmos DB Built-in Data Reader / Contributor (a separate role system, assigned via cosmosdb commands)
2. Assign at the narrowest scope that works (the storage account, not the subscription):
   `az role assignment create --assignee [object-id] --role "Storage Blob Data Contributor" --scope [resource-id]`
3. Wait 5-10 minutes. Role assignments propagate slowly; an immediate retry 403 is expected, not proof the fix failed.
4. Confirm with the same identity: `az role assignment list --assignee [object-id] --scope [resource-id]`.

What it is NOT: a bad key, a wrong endpoint, or a firewall. Those produce 401/404/timeout, not AuthorizationFailed. Do not rotate keys when you see this error.