Azure File Share Access Issue: Unauthorized Request Error with SAS URL

86107085 20

I have an Azure File Share that is accessed using Storage Explorer and a SAS URL. Initially, it works smoothly for browsing and uploading files, but then I start encountering the following error randomly:

This request is not authorized to perform this operation. RequestId XXXXXXXXXXXXXXXXX

At this point, I prefer not to switch to Entra ID authentication and want to continue using SAS for now.

What potential issues should be investigated to resolve this error?

Anonymous

2025-09-25T08:30:33.2433333+00:00

Hello @86107085,
Good day.

Could you please review my comment and let us know if it was helpful? If you need any further assistance, please feel free to reach us.

Regard's
Jeevan S

Answer accepted by question author

Anonymous

Hello @86107085,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand your question about the error “This request is not authorized to perform this operation” when using a SAS URL to access Azure File Shares. This usually means that the SAS token is either invalid, expired, or does not have the necessary permissions for the operation. Here are some important points to check:

SAS Token Validity: Please check if the SAS token is still valid at the time the error occurs. Since SAS tokens are time-limited, any request made after they expire will not work. Also, make sure the client machine's clock is set correctly to UTC, as a time mismatch can make SAS tokens seem expired earlier than they actually are.
Permissions on the SAS: Make sure the SAS token has the appropriate permissions, such as r for read, w for write, l for list, and d for delete. If you experience intermittent issues with browsing or uploading, confirm that the SAS includes both list and write permissions.
Scope of the SAS: Ensure the SAS is assigned to the correct resource type, whether that's service, container/share, or object/file level. Remember, a file-level SAS doesn't allow directory browsing, while a share-level SAS does.
Storage Account Settings: If you are using a Storage account firewall or network restrictions, make sure the client's IP address is permitted. Also, check if shared key access or SAS tokens are disabled at the account level.
Token Regeneration and Rotation: If the SAS was created with a Stored Access Policy, check to ensure the policy hasn't been changed or removed. You may also want to regenerate the SAS and test with a new token to eliminate the possibility of token corruption or policy updates.

Please refer below link for more information: Grant limited access to data with shared access signatures (SAS) - Azure Storage | Microsoft Learn

Next Action: Check your current SAS token to confirm its expiry, scope, and permissions. If needed, generate a new SAS from Azure Portal or CLI with the necessary permissions and test again. If the problem continues, record the failing request’s RequestId and Timestamp from the error message, these details can help with further analysis in the Azure Storage logs.

Since you prefer to use SAS, concentrating on the checks mentioned above should help identify and resolve the occasional authorization errors.

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to "Accept the answer” and “up-vote it” wherever the information provided helps you, this can be beneficial to other community members__.__ It would be greatly appreciated and helpful to others.

Anonymous

2025-09-26T08:12:16.0266667+00:00

Hello @86107085,
Good day.

Just checking in to see if you had a chance to see the previous response by Jeevan shanigarapu. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer. And, if you have any further questions do let us know.

Regard's
Jeevan S
Anonymous

2025-10-03T16:46:22.6733333+00:00

The issue was resolved by adding the necessary firewall rules. It happened because a firewall rule on the storage account was blocking traffic from proxy IPs. Once the proxy IP was identified and the rules were updated, the problem was fixed.

Answer recommended by moderator

86107085 20

Hi Jeevan

I think my problem was that the current firewall rule on the storage account doesn't allow traffic originating from my IP addresse which is behind a proxy.

After identifying the proxy IP , I updated the rules and now it's working.

Thank you for your support

0 comments

1 additional answer

86107085 20 Reputation points

2025-09-30T12:19:59.86+00:00

Hello Jeevan

Sorry for my late reply.

I have review and check all the recommandations in your comments but , i am still getting the authorization error:

I checked the azcopy logfile and found this:

###########

2025/09/29 14:45:10 ==> REQUEST/RESPONSE (Try=1/99.8344ms, OpTime=178.3346ms) -- RESPONSE STATUS CODE ERROR

DELETE https://SA.file.core.windows.net/.... REDACTED ...2F0C9A8095.JPG?se=2025sig=-REDACTED-.....

Accept: application/xml

User-Agent: AzCopy/10.29.1 azsdk-go-azfile/v1.3.0 (go1.24.2; Windows_NT)

X-Ms-Client-Request-Id: daebdb7a-c181-44bc-4c04-ed55e53c40a8

x-ms-allow-trailing-dot: true

x-ms-version: 2023-08-03

RESPONSE Status: 403 This request is not authorized to perform this operation.

Content-Length: 246

Content-Type: application/xml

Date: Mon, 29 Sep 2025 14:45:10 GMT

Server: Microsoft-HTTPAPI/2.0

X-Ms-Client-Request-Id: daebdb7a-c181-44bc-4c04-ed55e53c40a8

X-Ms-Error-Code: AuthorizationFailure

X-Ms-Request-Id: 4ce6f9ea-f01a-0016-0a4f-3130ae000000

Response Details: <Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation. </Message>

2025/09/29 14:45:10 ERR: [P#0-T#68] error deleting the (incomplete) file https://SA.file.core.windows.net/.... REDACTED ...2F0C9A8095.JPG?se=2025sig=-REDACTED-...... Failed with error DELETE https://SA.file.core.windows.net/.... REDACTED ...2F0C9A8095.JPG?se=2025sig=-REDACTED-.....

########

It looks like azcopy want to delete some incomplete file but does not have the right.

Below are the settings and rights of the SAS Tell me if you have an idea of what is preventing azcopy to delete incomplete files.

Thank you
Was this answer helpful?
Anonymous

2025-09-30T14:52:05.9366667+00:00

Hello @86107085,
Good day.

We have requested some details in a private message. Could you please check and share them in message with us?

Regard's
Jeevan S

Anonymous

2025-09-30T19:32:32.2933333+00:00

Hello @86107085,
Good day.

Thank you for providing the AzCopy logs and SAS configuration. The problem is happening because AzCopy is attempting to delete incomplete files from the upload, but the current SAS does not have enough permissions for all file operations.

To resolve this, please regenerate the SAS token using these settings:

Regenerate SAS with Broader Scope:

Go to the Azure Portal > Storage Account > Shared access signature:

-          Allowed services: Select "File"

-          Resource types: Switch from "Object" to Container (for share-level access) or Service (account-level for broader permissions). This allows operations on directories and temp files.

-          Permissions: Retain Read, Write, Delete, List, Create (ensure "Delete" applies to the share).

-          Start/Expiry: Set a longer validity (e.g., 7 days) to rule out timing issues.

-          Other Settings: Keep defaults; add your IP range if using restrictions.

Generate the new SAS URL and test in AzCopy/Storage Explorer.

Expected result: AzCopy should now delete incomplete files without 403 errors.

2. Manual Removal of Incomplete Files

Open the Azure Portal and navigate to Storage Account > File shares > Your share. Search for any partial or temporary files (such as those ending with .azcopy or with incomplete names), select them, and delete as needed.

·       Alternatively, you can use AzCopy with an Account Key for a one-time action if you have admin access.

azcopy login # Or use --account-key <your-key>

azcopy rm "https://<account>.file.core.windows.net/<share>/<path-to-incomplete-file>" --recursive=false

This removes orphans, enabling new uploads with the updated SAS.

3.Update AzCopy Commands and Version:

·       Please update your AzCopy command or Storage Explorer configuration by replacing the old SAS URL with the new one.

·       Update AzCopy to the latest version for improved SAS handling: Download from: Copy or move data to Azure Storage by using AzCopy v10 | Microsoft Learn

·       Run with verbose logging: azcopy cp "<source>" "https://<account>.file.core.windows.net/<share>?<new-sas>" --log-level DEBUG and check for path/scope mismatches.

4.Check and Test:

·       After generating a new SAS, try simulating an interrupted upload (such as by pressing Ctrl+C during transfer) to see if AzCopy properly cleans up.

·       To enable Storage Logs: go to Portal > Storage Account > Diagnostic settings > Add > Logs: StorageDelete > Send to Log Analytics. Then, use your RequestId to query for scope errors.

·       If the issue persists, review your storage account policies (like immutability or versioning) that could prevent deletions. If "Enables deletion of versions" is on, try disabling it.

For more information: Grant limited access to data with shared access signatures (SAS) - Azure Storage | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Anonymous

2025-10-03T09:58:19.8766667+00:00

Hello @86107085,
Good day.

We have shared a few steps in the Teams channel. Could you please follow those and let us know if you still encounter any issues?

Regard's
Jeevan S
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Azure File Share Access Issue: Unauthorized Request Error with SAS URL

1 additional answer

Your answer