Azure AuthorizationFailed: you have control-plane rights but not data-plane rights

Error text: AuthorizationFailed: The client ... does not have authorization to perform action 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'.

What it means: Entra ID authenticated you fine, but Azure RBAC denied the action. The action string in the message tells you exactly which permission is missing.

Fix pattern:

1. Read the action in the error. .../blobs/read = need Storage Blob Data Reader or better. .../secrets/getSecret/action = need Key Vault Secrets User. Map the action to the data role:

   • Storage blobs/queues/tables: Storage Blob/Queue/Table Data Contributor (or Reader)
   • Key Vault secrets/keys/certs: Key Vault Secrets User / Officer
   • Service Bus send/receive: Azure Service Bus Data Sender / Receiver / Owner
   • Cosmos DB documents: Cosmos DB Built-in Data Reader / Contributor (a separate role system, assigned via cosmosdb commands)

2. Assign at the narrowest scope that works (the storage account, not the subscription): az role assignment create --assignee [object-id] --role "Storage Blob Data Contributor" --scope [resource-id]

3. Wait 5-10 minutes. Role assignments propagate slowly; an immediate retry 403 is expected, not proof the fix failed.
4. Confirm with the same identity: az role assignment list --assignee [object-id] --scope [resource-id].

What it is NOT: a bad key, a wrong endpoint, or a firewall. Those produce 401/404/timeout, not AuthorizationFailed. Do not rotate keys when you see this error.

Proactive error-catalog skill. RBAC data-role mapping and assignment flow verified against current Azure RBAC and service docs. Evidence: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal