Ev2 Shell Extension with Managed Identity accessing Storage Account blob

Question

This is how we're accessing using MSI: 

 

Connect-AzAccount -Identity -TenantId $env:TenantId -SubscriptionId $env:SubscriptionId

        ## Attempt to upload payload to blob:
$ctx = (Get-AzStorageAccount -ResourceGroupName $env:ResourceGroupName -Name $env:StorageAccountName).Context
        
Set-AzStorageBlobContent -Container $env:BlobContainerName -Context $ctx -File "./${ingestor}.zip" -Force

 

But I see that in the activity logs, it is still performing listkeys, is this a known ev2 action? This is blocking us from turning off shared access key to storage accoutn and I couldn't find an appropriate existing blocker

Answer 1

Hi Minh Nguyen - Thanks for reaching out.

At the time you are creating the context object, try making use of below switch UseConnectedAccount which shall help formulating the context via the AD account that was used.

$ctx = New-AzStorageContext -StorageAccountName <Storage account name>  -UseConnectedAccount

Hope that helps!

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

@Minh Nguyen Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Based on the error message: Please enable Key access in the configuration settings of the Azure storage account.

Additional information: Error Message: Key based authentication is not permitted on this storage account

Please let us know if you have any further queries. I’m happy to assist you further.    

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.