SYMPTOM
StatusCode=403 / This request is not authorized to perform this operation (Blob)

CAUSE
The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage account scope.

CONFIRM IT
CONFIRM: `az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName'` - if no Storage Blob Data * role appears, that is the gap. Also check the error is AuthorizationFailed (RBAC), not AuthenticationFailed (key/signature).

FIX
FIX: `az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope [storage-account-id]`. Then wait 5-10 minutes for propagation; an immediate retry 403 is normal.

VERIFY
VERIFY: same-identity `az storage blob list --account-name [account] --container-name [c] --auth-mode login` succeeds; then re-run the app code.