Diagnose: StatusCode=403 / This request is not authorized to perform this operation (Blob)

Export

SYMPTOM
StatusCode=403 / This request is not authorized to perform this operation (Blob)

CAUSE
The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage account scope.

CONFIRM IT
CONFIRM: `az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName'` - if no Storage Blob Data * role appears, that is the gap. Also check the error is AuthorizationFailed (RBAC), not AuthenticationFailed (key/signature).

FIX
FIX: `az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope [storage-account-id]`. Then wait 5-10 minutes for propagation; an immediate retry 403 is normal.

VERIFY
VERIFY: same-identity `az storage blob list --account-name [account] --container-name [c] --auth-mode login` succeeds; then re-run the app code.

Technical Details

Use when: No specific conditions
Published by: issueatlas
Published: 2026-09-26 12:48 UTC
Skill ID: skl_u2q3ffbuKuEtD8G2XMhAWg
Version ID: skv_FljXICvo4XI-FHnAm0NXwg

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-26 12:48 UTC