az storage blob copy question

Question

I used to be able to copy a vendor provided vhd file to a storage blob using a command like this:

az storage blob copy start -u https://server.companyabc.com/samplefile.vhd -c copiedvhds -b sampleblob.vhd --account-name samplestorage1 --account-key "sample account key"

They changed the vhd file to be hidden behind a login now and am having trouble finding documentation on how to code a user name and password to access the vhd into the script. Feels like this should be fairly easy but am drawing up blanks. Would rather not download the file locally first if possible as it is a fairly large file so do not want to wait to download it locally only to then upload to Azure but if that is the only option please let me know as I believe then I will need to learn azcopy

Current error I am getting is which makes sense since it is not able to access the file unless authenticating first:

Unauthorized RequestId:ceee13b9-c01e-0023-3caf-db6b6b000000 Time:2025-06-12T15:32:18.6952003Z ErrorCode:CannotVerifyCopySource

Answer 1

Hi Ben,

Thank you for your question

You are encountering the "Unauthorized ErrorCode: CannotVerifyCopySource" because the vendor has changed the source VHD file’s access settings to require authentication (e.g., username/password or token). The az storage blob copy start command does not support authenticated URLs.

It only works with public or signed URLs like those with SAS tokens. Since the file is no longer public and Azure cannot log in to external systems, it fails to verify or download the file, resulting in the error.

Here’s a step-by-step guide to resolve your issue by downloading the VHD file with authentication and uploading it to Azure Blob Storage using AzCopy.

It includes references to the Azure Portal and command-line steps. Manually download the VHD file from the vendor's source to your local machine.

Since the file is behind a login, you should use a tool like curl or your browser to download it.

Run :

curl -u username:password -O https://server.companyabc.com/samplefile.vhd

Replace "username" and "password" with your actual login credentials.

 

Generate SAS tokens in the Azure Portal :  Azure requires authenticated access to upload blobs, and your original copy method no longer works with authenticated source URLs. The SAS token enables secure, permission-based access to your storage container for tools like AzCopy during the upload process.

   Go to Azure Portal
➡️ Navigate to your Storage Account
➡️ Under Data storage, click Containers
➡️ Select or create a container (e.g., copiedvhds)
➡️ Click Shared access signature in the left menu
➡️ Choose permissions: Write, Create, and List
➡️ Click Generate SAS token and URL
➡️ Copy the Blob SAS URL.

 

Upload the VHD Using AzCopy : Uploading the VHD using AzCopy is necessary because the source file requires authentication, which az storage blob copy does not support. AzCopy allows you to manually download the file and then efficiently upload it to Azure Blob Storage using a SAS token.

Install AzCopy if you haven’t already: Get started with AzCopy 

Run : 

azcopy copy 

Replace <storageaccount> and <SAS-token> with your actual values.

  

If the VHD file requires additional authentication, such as a username and password, you might need to manage that separately. Consider using a temporary token or a Shared Access Signature (SAS) if the server supports it.

References:

• Authorize access to blobs and files with AzCopy and Microsoft Entra ID
• Use AzCopy to copy blobs between Azure storage accounts with network restrictions

Hope the above answer helps! Please let us know do you have any further queries.

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.