Api management access table storage with managed identity getting 403?

Question

Hello,

In my inbound section i have a send-request policy to do a post to my table storage. Within the send-request i'am using:

<authentication-managed-identity resource="https://storage.azure.com/" />

I'am getting: "Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.".

In the same api i also use managed-identity to access Azure Service Bus and that is working fine.

What can be the reason this fails with table storage or how can i proceed to get to the problem?

Best regards,

Michel

Answer 1

Hello Michel,

Thank you for posting your query here!

To call Azure Table Storage from Azure API Management using Managed Identity, enable the system-assigned identity for your API Management instance.

Under "Access control (IAM)," assign the Managed Identity associated with your API Management instance a role with sufficient permissions, such as "Storage Table Data Contributor."

Then in the API Management API configure the inbound policy.

Please note that we need to specify x-ms-version in the request header and its value should be 2017-11-09 or higher.

You may try to add this to your inbound policy:

<set-header name="x-ms-version" exists-action="override">
    <value>@{string version = "2017-11-09"; return version;}</value>
</set-header>

Here is a post on similar query that might help: https://stackoverflow.com/questions/75327677/unauthorized-access-to-storages-table-using-api-management

Please let us know if you have any further queries. I’m happy to assist you further.

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.