Custom Vision Publish Error: AuthorizationFailed on Storage Encryption Scopes

Question

Custom Vision Publish Error: AuthorizationFailed on Storage Encryption Scopes

Platformation AI 0

Hi everyone,

I'm having a very frustrating issue trying to publish a Custom Vision model, and I keep getting the same AuthorizationFailed error every time.

Here is the exact error message:

"error":{"code":"AuthorizationFailed","message":"The client '*****' with object id '' does not have authorization to perform action 'Microsoft.Storage/storageAccounts/encryptionScopes/read' over scope '/subscription//resourceGroups/iris-UKSouth-prod-data/providers/Microsoft.Storage/storageAccounts/irisprodukspredictions/encryptionScopes/****' or the scope is invalid."

What I'm doing:

I built a Custom Vision Object Detection Model.
When I click Publish and choose my prediction resource (PlatformationLogoDetection-Prediction), the publish operation fails instantly with the error above.

What’s confusing:

I cannot see the storage account mentioned in the error (irisprodukspredictions) anywhere in my subscription.
I have Developer Support and Contributor access on my subscription.
My Storage Accounts page shows zero storage accounts.
It looks like Custom Vision is pointing to a storage account in a completely different subscription (iris-UKSouth-prod-data), which I don’t have permission to view.
Because of this, the service cannot read encryption scopes and the publish fails.

What I’ve tried:

Checked region alignment (all UK South).
Checked IAM access on my resources.
Recreated the Custom Vision resources.
Tried multiple publish attempts.
Tried creating a support request in Azure Portal, but I keep getting sent into troubleshooters and cannot reach the real support ticket wizard.

My question:

Why is Custom Vision trying to read encryption scopes from a storage account I cannot access, and how can I give myself (or the Custom Vision service) the correct RBAC permissions?

Any help would be really appreciated - this is blocking me from deploying my model.

Best regards,
Noah

Note: All PII information redacted from support side.

Aryan Parashar 3,690 Reputation points Microsoft External Staff Moderator

2025-11-24T06:52:38.59+00:00

Hi Platformation AI,

I completely understand the situation you are facing, and I appreciate your patience.

You are absolutely correct: the Custom Vision service is indeed capable of accessing a blob storage account hosted in a different subscription. However, the specific resource you are currently using does not yet have the necessary authorization to access the target storage account.

I realize that navigating permission errors across different subscriptions can be frustrating, but you can resolve this in one of two ways:

Request Access: You can request the necessary RBAC permissions (specifically "Storage Blob Data Contributor" roles) for the storage account located in the iris-UKSouth-prod-data subscription.

Or you need to create a new storage account or have a storage account of which you have RBAC permission to store and upload files which you can check while creating the project as shown below: Let me know if you are still facing issues.

Thank you for reaching out to The Microsoft Q&A Portal.
Aryan Parashar 3,690 Reputation points Microsoft External Staff Moderator

2025-11-25T07:40:51.61+00:00

Hi Platformation AI,

Please let me know if you’ve had a chance to try the suggested workaround, I’m here if you need further help.