**TL;DR:** Symptom: StatusCode=403 / This request is not authorized to perform this operation (Blob) Cause: The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage accou FIX FIX: az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope... CONFIRM IT CONFIRM: az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName' - if no Storage Blob Data * role appears, that is the gap.

## The error

```text
StatusCode=403 / This request is not authorized to perform this operation (Blob) Cause: The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage accou CONFIRM IT 
```

## The fix

**TL;DR:** Symptom: StatusCode=403 / This request is not authorized to perform this operation (Blob) Cause: The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage accou CONFIRM IT CONFIRM: az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName' - if no Storage Blob Data * role appears, that is the gap. FIX FIX: az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope...

## The fix

SYMPTOM
StatusCode=403 / This request is not authorized to perform this operation (Blob)

CAUSE
The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage account scope.

CONFIRM IT
CONFIRM: `az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName'` - if no Storage Blob Data * role appears, that is the gap. Also check the error is AuthorizationFailed (RBAC), not AuthenticationFailed (key/signature).

FIX
FIX: `az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope [storage-account-id]`. Then wait 5-10 minutes for propagation; an immediate retry 403 is normal.

VERIFY
VERIFY: same-identity `az storage blob list --account-name [account] --container-name [c] --auth-mode login` succeeds; then re-run the app code.

## When to use this

- This covers exactly what the title says: Diagnose.
- You are setting this up for the first time, or auditing an existing setup.
- You want the key gotchas in one place before you start.

## When not to use this

- You are doing a different workflow with Diagnose; these steps are specific to the title above.
- You need the full reference docs; this is the short path, not the manual.

## Compatibility

- Not pinned to a specific version; follows current Diagnose behavior.