Azure Automation Account connection to Storage Account

Question

Hi, I would like to request some support on this.

I have created a PowerShell script to transfer data from a blob container to an Azure fileshare, this script is inside an automation account runbook, both storage accounts where the blob and fileshare belong to the same resource group.

The Automation account has a system-managed identity configured as contributor role, with the storage account resource group.

The thing here is the storage account where the blob storage is stored, has configured the option "Enabled from selected virtual networks and IP addresses" in the Public network access section. It is causing the automation account to fail in the execution, obtaining:

This request is not authorized to perform this operation. HTTP Status Code: 403 - HTTP Error Message: This request is not authorized to perform this operation. ErrorCode: AuthorizationFailure ErrorMessage: This request is not authorized to perform this operation.

The created script, was tested in storage accounts with Public network access configured as Enable from all networks, and the procedure works fine.

Answer 1

It appears here that the issue is that the Azure Automation account, is unable to access the storage account due to network restrictions. When network access is limited to selected virtual networks and IP addresses, we need to add the public IP of the Automation Account to the storage account’s network settings.
If the Automation account has a static IP address, you can add this IP to the list of allowed IP addresses in the storage account’s network settings.

If the IP address is not static, you may need to allow the entire IP range for the Azure region where your Automation account is located. This not always ideal, but is a potential solution to the issue.