Azure AuthorizationFailed: you have control-plane rights but not data-plane rights

TL;DR: The classic 403: your role assignment lets you manage the resource but not touch its data. Storage, Key Vault, Service Bus, and Cosmos DB each need their own data role on top of Contributor. Fix pattern: 1. Read the action in the error. .../blobs/read = need Storage Blob Data Reader or better. .../secrets/getSecret/action = need Key Vault Secrets User.

The error

AuthorizationFailed: The client ... does not have authorization to perform action 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'

The fix

1. Read the action in the error. .../blobs/read = need Storage Blob Data Reader or better. .../secrets/getSecret/action = need Key Vault Secrets User. Map the action to the data role:
2. Storage blobs/queues/tables: Storage Blob/Queue/Table Data Contributor (or Reader)
3. Key Vault secrets/keys/certs: Key Vault Secrets User / Officer
4. Service Bus send/receive: Azure Service Bus Data Sender / Receiver / Owner
5. Cosmos DB documents: Cosmos DB Built-in Data Reader / Contributor (a separate role system, assigned via cosmosdb commands)
6. Assign at the narrowest scope that works (the storage account, not the subscription): az role assignment create --assignee [object-id] --role "Storage Blob Data Contributor" --scope [resource-id]
7. Wait 5-10 minutes. Role assignments propagate slowly; an immediate retry 403 is expected, not proof the fix failed.
8. Confirm with the same identity: az role assignment list --assignee [object-id] --scope [resource-id]. What it is NOT: a bad key, a wrong endpoint, or a firewall. Those produce 401/404/timeout, not AuthorizationFailed. Do not rotate keys when you see this error.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Azure AuthorizationFailed.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Azure behavior.

Proactive error-catalog skill. RBAC data-role mapping and assignment flow verified against current Azure RBAC and service docs. Evidence: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal