Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

Question

Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

Steven P. Harris 0

Hi All,

In a Corporate network, I have configured STT services as per this KB:
https://www.libertyrecording.com/LCR_STT_Configuration.htm

However, we continually note:
userlog: Error! SrcFile: C:\Test\recording.dcr;
Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

If we do this outside (e.g. from Home) the issue does not occur.

How can I further diagnose this issue?

19F0 30-13:30:29.479 ConvStt: UploadToAzStrg>> [E:\PRM\Temp\recording.mp3]

19F0 30-13:30:30.319 ConvStt: UploadToAzStrg<< [https://stt.blob.core.windows.net/container/C:/Test/recording.dcr]

19F0 30-13:30:30.329 UploadList: Add: C:\Test\recording.dcr

19F0 30-13:31:10.380 ConvStt: cloud[0]: stat = ErrorPermanent(3), [C:\Test\recording.dcr]

19F0 30-13:31:10.380 userlog: Error! SrcFile: C:\Test\recording.dcr; Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

19F0 30-13:31:10.400 NotifyList: Add: C:\Test\recording.dcr

19F0 30-13:32:10.056 ConvStt: check(0): [C:\Test\recording.dcr] (strg(1) [fld_err][])

19F0 30-13:32:10.056 userlog: Processing started. SrcFile: C:\Test\recording.dcr

19F0 30-13:32:10.056 WFile: open>> [E:\PostRecordingManager\Temp\recording.dcr]

19F0 30-13:32:10.076 WFile: open<< (size: 8910054 bt, len: 5:01 sec)

19F0 30-13:32:10.076 WFile: stt isn't skipped: diff data ctrlsum

Thanks!

Vinodh247 42,451 Reputation points MVP Volunteer Moderator

2025-08-30T07:07:18.4566667+00:00
Hi ,

Thanks for reaching out to Microsoft Q&A.

This error is very likely due to corporate network restrictions or firewall/proxy rewriting of the Azure Storage URL, which is causing the InvalidUri and authentication failure. Corporate proxies or SSL inspection tools can rewrite the HTTPS request or strip SAS tokens from Azure Blob URLs.

Firewall rules might be blocking or filtering outbound HTTPS calls to *.blob.core.windows.net.

There might also be an internal DNS issue if the URL cannot resolve correctly in the corporate environment.

Check outbound connectivity

From the corporate machine, run:
nslookup stt.blob.core.windows.net

curl -I https://stt.blob.core.windows.net/

Ensure the domain resolves and the request is not blocked or redirected.

Check corporate proxy or firewall

Ask the network team if outbound HTTPS traffic to *.blob.core.windows.net is filtered or requires a proxy bypass rule.

Inspect with a tool like Fiddler or Wireshark to see if the SAS token in the request is modified or dropped.

Validate the SAS token format

Compare the token when connected through corporate network vs. home network.

If the token is being corrupted or partially rewritten, you will see authentication failures.

Check the LCR STT configuration

In LCR_STT_Configuration.ini or equivalent config file, ensure:

No absolute local paths (like C:\Test\...) are being injected into the Azure blob URL.

The file names are encoded properly when sent to Azure.

Bypass inspection

Temporarily test from the corporate machine outside the proxy (e.g., hotspot your laptop or request a proxy bypass) to confirm the issue is network-policy-related.

Collect debug logs

Enable verbose logging in the Liberty STT configuration.

Send the logs to Liberty support if the issue persists; they may have patches for encoding issues triggered by certain environments.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.
Steven P. Harris 0 Reputation points

2025-08-30T11:42:38.96+00:00

Hi Vinodh247

Unfortunately, I continually get "You are not authorized to make this response. If you believe this to be in error, please refresh the page and try again."

Given then above, all I can communicate to you is very basic information by the looks as I'm assuming this is a public forum and technical information / Microsoft STT IP addresses etc cannot be shared.

the nslookup
Non-authoritative answer: worked

curl -I https://stt<account>.<>
HTTP/1.1 400 Value for one of the query parameters specified in the request URI is invalid.

The wireshark trace

(SNI=stt_account.blob.core.windows.net)

(SNI=australiaeast.api.cognitive.microsoft.com)

(SNI=ecs.office.com)

19F0 30-21:33:20.897 ConvStt: UploadToAzStrg<< [https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/C:/Test/Test.dcr]

19F0 30-21:33:20.907 UploadList: Add: C:\Test\test.dcr

19F0 30-21:34:00.708 ConvStt: cloud[0]: stat = ErrorPermanent(3), [C:\Test\Test.dcr]

19F0 30-21:34:00.708 userlog: Error! SrcFile: C:\Test\Test.dcr; Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

Thank you
Manas Mohanty 16,755 Reputation points Microsoft External Staff Moderator

2025-09-01T05:40:21.0066667+00:00
Hi Steven P. Harris

Thank you for the diagnostics.

Here is my analysis

[https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/C:/Test/Test.dcr]

Please sanitize the blob URLs

Correct: https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/Test.dcr Incorrect: https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/C:/Test/Test.dcr

I have requested info on private message to create a support ticket and connect through team's call.
Steven Harris 6 Reputation points

2025-09-01T11:53:00.3933333+00:00

Hi Manas,

I don’t see any private message option or notifications on my profile — could you please resend it, or provide another way to securely share my subscription details?”

Thanks
Manas Mohanty 16,755 Reputation points Microsoft External Staff Moderator

2025-09-02T11:23:15.6666667+00:00

Hi Steven Harris

I have tried to contact you on private message option on top of 1st comment. Please reply there.

Looking forward to hearing from you.

Thank you.

1 answer

Your answer

Steven P. Harris 0 Reputation points

2025-08-30T11:42:38.96+00:00

Hi Vinodh247

Unfortunately, I continually get "You are not authorized to make this response. If you believe this to be in error, please refresh the page and try again."

Given then above, all I can communicate to you is very basic information by the looks as I'm assuming this is a public forum and technical information / Microsoft STT IP addresses etc cannot be shared.

the nslookup
Non-authoritative answer: worked

curl -I https://stt<account>.<>
HTTP/1.1 400 Value for one of the query parameters specified in the request URI is invalid.

The wireshark trace

(SNI=stt_account.blob.core.windows.net)

(SNI=australiaeast.api.cognitive.microsoft.com)

(SNI=ecs.office.com)

19F0 30-21:33:20.897 ConvStt: UploadToAzStrg<< [https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/C:/Test/Test.dcr]

19F0 30-21:33:20.907 UploadList: Add: C:\Test\test.dcr

19F0 30-21:34:00.708 ConvStt: cloud[0]: stat = ErrorPermanent(3), [C:\Test\Test.dcr]

19F0 30-21:34:00.708 userlog: Error! SrcFile: C:\Test\Test.dcr; Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

Thank you
Manas Mohanty 16,755 Reputation points Microsoft External Staff Moderator

2025-09-01T05:40:21.0066667+00:00

Hi Steven P. Harris

Thank you for the diagnostics.

Here is my analysis

[https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/C:/Test/Test.dcr]

Please sanitize the blob URLs

Correct: https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/Test.dcr Incorrect: https://sttcatlccprdause1.blob.core.windows.net/prmstt-c-cafbb8c4/C:/Test/Test.dcr

I have requested info on private message to create a support ticket and connect through team's call.
Steven Harris 6 Reputation points

2025-09-01T11:53:00.3933333+00:00

Hi Manas,

I don’t see any private message option or notifications on my profile — could you please resend it, or provide another way to securely share my subscription details?”

Thanks
Manas Mohanty 16,755 Reputation points Microsoft External Staff Moderator

2025-09-02T11:23:15.6666667+00:00

Hi Steven Harris

I have tried to contact you on private message option on top of 1st comment. Please reply there.

Looking forward to hearing from you.

Thank you.

Answer 1

Manas Mohanty 16,755 Microsoft External Staff Moderator

Hi Steven P. Harris

We could not hear from. Hope the pointers worked from you.

Temporarily closing the case until we hear back from you.

Attached case summary for your reference.

Issue- Authentication to speech service failing in Secured environment

Troubleshooting done at support

1.Verified from customer statement that DNS resolution is working.

2.Storage URLs were not correct so suggested to fix malformed URLs.

19F0 30-21:34:00.708 userlog: Error! SrcFile: C:\Test\Test.dcr; Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

Thank you

Steven Harris 6 Reputation points

2025-10-18T06:31:47.6433333+00:00

Hi All,

Just an update: diagnostic debug below reports a 403 AuthorizationFailure.

Any hints most appreciated!

OnPrem STT App configured using:

STT service } Key and Region
Use Azure storage | account name \ account key \ container

Azure Storage Account:
Public network access
Enabled from selected networks <subnets>
Exceptions: allow trusted Microsoft services to access this resource (is ticked)

Shared access signature
Allowed permissions (all ticked)
Exceptions: allowed resource types (service, container, object) unticked

Diagnostic JSON SNIPL
"sourceAccessTier":"Invalid"
"uri": "https://stt.blob.core.windows.net:443/sastt/<file>"
"protocol": "HTTPS"
"resourceType": "Microsoft.Storage/storageAccounts/blobServices"
"time": "2025-10-18T03:17:20.8079691Z"
"resourceId": "/subscriptions/xxxx/resourceGroups/rg-xxx/providers/Microsoft.Storage/storageAccounts/sastt/blobServices/default"
"category": "StorageRead"
"operationName": "GetBlobProperties"
"operationVersion": "2021-10-04"
"schemaVersion": "1.0"
"statusCode": 403
"statusText": "AuthorizationFailure"
"durationMs": 3
"callerIpAddress": "10.240..:402*"*
"correlationId": "<ID>"
"identity": "type":"SAS"
"tokenHash":"key1(xxxx)
SasSignature(xxxx)"
"location": "<>"

"properties": "accountName":"sttaccount" Note

#IP address redacted from error trace from support side
Manas Mohanty 16,755 Reputation points Microsoft External Staff Moderator

2025-10-21T11:54:59.75+00:00
Hey Steven Harris

Here is the analysis based on error trace.

Error Details

statusCode: 403 and statusText: AuthorizationFailure → The request was rejected due to invalid or insufficient permissions.

identity: type: SAS → Access was attempted using a Shared Access Signature.

sourceAccessTier: "Invalid" → Indicates the SAS token or request did not specify a valid access tier - Please specify tier type while generating SA

SAS Configuration Issues

Allowed permissions: all ticked

Allowed resource types: service, container, object → UNTICKED This is critical: if resource types are not selected, the SAS cannot access blobs even if permissions are granted.

URI Format

https://stt.blob.core.windows.net:443/sastt/<file> The path suggests a container named sastt. If the SAS was generated without including this container or object resource type, the URI will fail.

Network Restrictions

Public network access: Enabled from selected subnets If the caller IP (10.240.*.*) is not in the allowed subnet list, the request will fail even with a valid SAS.

Hope it helps.

Requesting to create a new thread if you need further assistance.

Thank you

Share via

Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

1 answer

Your answer