Troubleshooting Azure Storage Account Permissions
Here’s a quick cheat sheet on narrowing down Azure Storage account permission issues as well as troubleshooting blob storage errors.
TROUBLESHOOTING ISSUES WITH ACCESSING THE STORAGE ACCOUNT ITSELF
COMMON CAUSE 1: YOUR NETWORK HASN’T BEEN WHITELISTED
When you try to access the Container (Storage account > Data storage > Containers > Your Container) it gives you an error 403:
To check and confirm if your IP address is whitelisted go to:
Storage account > Security + Networking > Networking > Public network access > Manage
For this example we could configure a Private endpoint to access the storage account, however we’ll instead change the setting to ‘Enable’ and add our public IP address:
COMMON CAUSE 2: INSUFFICIENT ROLE PRIVILEGES
This error message below is due to insufficient privileges.
We can check what roles the user has and assign them as necessary:
EMAIL="UserEmailAddress@domain.com"az role assignment list --assignee $EMAIL --all --output table
We’ll have to add the necessary roles for what access is needed.
Get Lumenyx’s stories in your inbox
Join Medium for free to get updates from this writer.
Examples of roles to add:
- Reader
- Storage Blob Data Contributor
- Storage Blob Data Owner
TROUBLESHOOTING ISSUES WITH ACCESSING FILES IN STORAGE ACCOUNTS
COMMON CAUSE 1: BLOB ANONYMOUS ACCESS IS DISABLED
The issue may be that Blob anonymous access is disabled. Whether it should or shouldn’t be disabled depends on the organisation, however this is something to check.
Check:
Storage Account > Settings > Configuration > Allow Blob anonymous access
COMMON CAUSE 2: THE ACCESS LEVEL ON THE CONTAINER IS SET TO PRIVATE
Go to:
Storage account > Storage browser > Blob containers > Change access level
Changing the setting as a test has confirmed that this was the issue:
COMMON CAUSE 3: THE STORAGE ACCOUNT KEY ACCESS IS DISABLED
When “Allow storage account key access” is disabled, anything that relies on the storage account keys stops working.
Roles like the Storage Account Contributor role or even the Owner role can retrieve the account keys and use them to reach the data, however if the storage account key access is disabled, then anyone using this role will be denied.
