Datafactory call blob rest API using Webactivity with managed identity

Chand, Anupam SBOBNG-ITA/RX 451

I would like to apply a legal hold on a blob using the Blob rest API. I would like to do this using a webactivity on an Azure data factory. Even though Webactivity has managed identity as an authentication option, I'm unable to get this to work.
Is there a way I can call the apply legal hold rest api using a webactivity without the need to create any Service principal or credentials as such?

AnnuKumari-MSFT 31,151 Reputation points Microsoft Employee

2022-10-03T10:23:39.26+00:00

Hi @Chand, Anupam SBOBNG-ITA/RX ,

Thankyou for using Microsoft Q&A platform and thanks for posting your question here.

As per my understanding, you are trying to set legal hold on a blob. During the process, you are facing authorization issue. Please let me know if my understanding is incorrect.

Could you please share the screenshot of the web activity configuration you have set. When you say you are using managed identity, is that system assigned managed identity or user assigned managed identity. Does the managed identity have owner permission?

Setting legal hold on blob operation can only be called by the storage account owner and by anyone with a Shared Access Signature that has permission to legal hold, the i SAS permission.

It would be helpful if you can share the error you are facing when you use managed identity. Looking forward to your response. Thanks
AnnuKumari-MSFT 31,151 Reputation points Microsoft Employee

2022-10-07T09:00:52.223+00:00

Hi @Chand, Anupam SBOBNG-ITA/RX ,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .In case if you have any resolution please do share that same with the community as it can be helpful to others . Otherwise, will respond back with the more details and we will try to help
Chand, Anupam SBOBNG-ITA/RX 451 Reputation points

2022-11-04T06:22:59.967+00:00

Hi. I tried applying owner permissions to a service principal at the storage account level. Then I tried calling the PUT legal hold API and got the attached error.