How to fix "MSIForBiddenForFileShareStorage" error

Question

On Azure AI Studio, in chat playground, when choosing my own data source and then trying to create a prompt flow, there's an error: "Unable to create flow. MSIForbiddenForFileShareStorage: Unable to authenticate data access to storage account with workspace MSI, please refer the doc link (which I can't do as another window opens and I am not able to click on "more details") to setup workspace MSI correctly.

Which settings does this error refer to?

Answer 1

@Veeti Rajaniemi

Welcome to Microsoft Q&A Forum, Thanks for posting here!!

From the below error message, it looks like a RBAC permission Issue.

"Unable to create flow. MSIForbiddenForFileShareStorage: Unable to authenticate data access to storage account with workspace MSI,

If you are using user identity or managed identity to authenticate the Storage

credential-less datastore in prompt flow, you need to grant enough permissions to user identity or managed identity to access the datastore.

• Make sure workspace system assigned managed identity have Storage Blob Data Contributor and Storage File Data Privileged Contributor on the storage account, at least need read/write (better also include delete) permission.
• If you're using user identity this default option in prompt flow, you need to make sure the user identity has following role on the storage account:
  • Storage Blob Data Contributor on the storage account, at least need read/write (better also include delete) permission.
    • Storage File Data Privileged Contributor on the storage account, at least need read/write (better also include delete) permission.
    • If you're using user assigned managed identity, you need to make sure the managed identity has following role on the storage account:
      • Storage Blob Data Contributor on the storage account, at least need read/write (better also include delete) permission.
        • Storage File Data Privileged Contributor on the storage account, at least need read/write (better also include delete) permission.
          • Meanwhile, you need to assign user identity Storage Blob Data Read role to storage account at least, if you want to use prompt flow to authoring and test flow.
• If you still can't view the flow detail page and the first time you using prompt flow is earlier than 2024-01-01, you need to grant workspace MSI as Storage Table Data Contributor to storage account linked with workspace.

Reference Link: https://learn.microsoft.com/en-us/azure/machine-learning/prompt-flow/troubleshoot-guidance?view=azureml-api-2#grant-permission-to-user-identity-or-managed-identity

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members

Answer 2

Hello Veeti Rajaniemi,

Greetings! Welcome to Microsoft Q&A Platform.

I understand that you are encountering a permissions issue with the Managed Service Identity (MSI) when trying to access the storage account in Azure AI Studio and getting the error "Unable to create flow. MSIForbiddenForFileShareStorage: Unable to authenticate data access to storage account with workspace MSI. Please consider checking the below following factors to resolve the issue.

1.Ensure you have the system assigned managed identity principal enabled for your Azure AI Search resources.

• Using the Azure portal, navigate to your resource, and select Identity from the navigation menu on the left side of the screen.
• Set Status to On.
• Perform these steps for both of your Azure OpenAI and Azure AI Search resources.

2.Navigate back to your storage account. Select Access Control (IAM) for your resource. Select Add, then Add role assignment. In the window that appears, add the Storage Data Contributor role to the storage resource for your Azure OpenAI and search resource's managed identity.

• Assign access to Managed Identity.
• If you have multiple search resources, Perform this step for each search resource.

3.If your storage account hasn't already been network restricted, go to networking tab and select Enabled from selected virtual networks and IP addresses.

refer this Ms. doc for more detailed guidance -https://learn.microsoft.com/en-us/azure/ai-studio/Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.