Diagnose: StatusCode=403 / This request is not authorized to perform this operation (Blob)

TL;DR: Symptom: StatusCode=403 / This request is not authorized to perform this operation (Blob) Cause: The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage accou FIX FIX: az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope... CONFIRM IT CONFIRM: az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName' - if no Storage Blob Data * role appears, that is the gap.

The error

StatusCode=403 / This request is not authorized to perform this operation (Blob) Cause: The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage accou CONFIRM IT 

The fix

TL;DR: Symptom: StatusCode=403 / This request is not authorized to perform this operation (Blob) Cause: The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage accou CONFIRM IT CONFIRM: az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName' - if no Storage Blob Data * role appears, that is the gap. FIX FIX: az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope...

The fix

SYMPTOM StatusCode=403 / This request is not authorized to perform this operation (Blob)

CAUSE The identity authenticated but lacks the Storage Blob Data role. Subscription Owner/Contributor covers the control plane only; blob data needs Storage Blob Data Reader/Contributor at the storage account scope.

CONFIRM IT CONFIRM: az role assignment list --assignee [object-id] --scope [storage-account-id] --query '[].roleDefinitionName' - if no Storage Blob Data * role appears, that is the gap. Also check the error is AuthorizationFailed (RBAC), not AuthenticationFailed (key/signature).

FIX FIX: az role assignment create --assignee [object-id] --role 'Storage Blob Data Contributor' --scope [storage-account-id]. Then wait 5-10 minutes for propagation; an immediate retry 403 is normal.

VERIFY VERIFY: same-identity az storage blob list --account-name [account] --container-name [c] --auth-mode login succeeds; then re-run the app code.

When to use this

• This covers exactly what the title says: Diagnose.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Diagnose; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Diagnose behavior.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-python