Unable to use Azure Storage Explorer (Preview) in portal

Question

Storage Explorer in the portal does not work for a user that is RBAC'd for Reader on the account, and Storage Blob Data Contributor on a container. The storage account shows in the explorer but when I expand it I get this error: 

"Error responseJSON: {"error":{"code":"AuthorizationFailed","message":"The client 'demo_1@xxxxxxx.onmicrosoft.com' with object id 'xxxxxxxxxxxxxxxxx' does not have authorization to perform action 'Microsoft.Storage/storageAccounts/listKeys/action' over scope '/subscriptions/xxxxxxxxxxx/resourceGroups/rg-az-203/providers/Microsoft.Storage/storageAccounts/storaz203' or the scope is invalid. If access was recently granted, please refresh your credentials."}} status: 403" 

Storage Explorer Desktop DOES WORK as expected for the user.

I have no issues with the portal Storage Explorer when signed in as Global Administrator.

The Global Admin account is a Microsoft account. The account I'm having trouble with is an Azure AD account. The Azure AD Tenent is the Free level.

[Note: As we migrate from MSDN, this question has been posted by an Azure Cloud Engineer as a frequently asked question.] Source: MSDN

Answer 1

Hello,
I guess, your account is missing a required RBAC role: Storage Blob Data Reader

Assign both Reader and Storage Blob Data Reader roles to the user. The first one is required for the user to see the storage account resource in the Portal. Storage Blob Data Reader is required to access data without keys.

Regards,
Manu

Answer 2

I've ran into the same problem with both the 'Reader' and 'Storage Blob Data Reader' roles assigned to my user account. The problem is that using Azure AD credentials is not currently supported for the 'Storage Explorer (Preview)' as mentioned here: https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-portal#assign-the-reader-role-for-portal-access, see the 'Important' message at the bottom. Same thing applies to getting read-access keys.

One can, however, read data from 'Blob Service' with these two roles.