Balaji Ramamoorthy
Download CV

Azure Storage 403 error: AuthorizationFailure or AuthorizationPermissionMismatch

Real issue · 2 min read

The two 403 errors look alike but have different causes: the storage firewall, or a missing data role. How to tell them apart and fix each.

Share on LinkedIn

Symptom

A user, script or application cannot read or write a blob, file or queue in an Azure storage account. The error is a 403 with one of these messages:

  • AuthorizationFailure: "This request is not authorized to perform this operation."
  • AuthorizationPermissionMismatch: "This request is not authorized to perform this operation using this permission."

Both look similar in the portal and in AzCopy, but they have different causes.

Where it happened

Storage accounts with the firewall turned on, accounts reached through a private endpoint, and accounts where access is given through Microsoft Entra ID roles.

What I checked

  1. Is the caller coming from an allowed network? Open the storage account, then Networking. If the setting is "Enabled from selected virtual networks and IP addresses", only those addresses and networks can connect.
  2. Which public IP address is the caller using? A laptop on a home network or behind a VPN may not be the address you think.
  3. How is the caller signing in? An account key or shared access signature behaves differently from an Entra ID sign-in.
  4. Does the signed-in identity have a data role? Owner, Contributor and Reader manage the storage account. They do not give access to the data.
(Get-AzStorageAccount -ResourceGroupName rg-data -Name stdata001).NetworkRuleSet
Get-AzRoleAssignment -SignInName [email protected] -Scope $storageAccountId

Root cause

  • AuthorizationFailure usually means the request was blocked by the storage firewall, or the shared key or SAS token is wrong or expired.
  • AuthorizationPermissionMismatch means the network path was fine, but the Entra ID identity has no data-plane role, or the wrong one. For example, a user with Owner on the account but no Storage Blob Data role cannot list blobs when signing in with Entra ID.

The fix

For a network block, add the caller's address or network, or use a private endpoint:

Add-AzStorageAccountNetworkRule -ResourceGroupName rg-data -Name stdata001 -IPAddressOrRange 203.0.113.25

For a role problem, give the identity the narrowest data role that does the job, scoped to the account or the container:

New-AzRoleAssignment -SignInName [email protected] -RoleDefinitionName 'Storage Blob Data Contributor' -Scope $storageAccountId

Role assignments can take several minutes to apply. Sign out and in again, or get a new token, before testing. When using the Azure CLI, add --auth-mode login so the command uses the Entra ID identity and not an account key.

How to stop it happening again

  • Prefer Entra ID roles over account keys. Turn off shared key access on accounts that do not need it.
  • Use private endpoints for production data, with the private DNS zone linked to the networks that need it.
  • Document which team owns each data role, and review the assignments on a schedule.