Time-based retention policy blocks the downloading of blobs in ADLS2

Question

I have a time-based retention policy on a container in Azure blob storage/ Data Lake Gen 2. I set this up so I can write once, never delete or modify, and then keep the files accessible. However, now that the policy is in place I cannot download the data anymore: I keep getting the message: “This operation is not permitted as the blob is immutable due to a policy.” In my code. When using AZCopy I get “409 This operation is not permitted as the blob is immutable due to a policy. When Downloading response body.” . I am not trying to delete or modify anything in the blobs, just download them. Is the download operation somehow modifying the blob?

I was under the impression that the policy keeps anyone from modifying/ deleting the blobs, not that it restricts the downloading of the blobs. How can I download the files while keeping them un-deletable/ un-modifiable? 

Answer 1

@Adam B - Thanks for the question and using MS Q&A platform.

It seems that you have set up a time-based retention policy on a container in Azure blob storage/ Data Lake Gen 2 to keep the files un-deletable/ un-modifiable. However, you are unable to download the data anymore and getting the message "This operation is not permitted as the blob is immutable due to a policy." This error message indicates that the blob is immutable due to the policy, and the download operation is not permitted as it is considered a modification of the blob.

To download the files while keeping them un-deletable/ un-modifiable, you can create a snapshot of the blob before applying the retention policy. Snapshots are read-only copies of the blob that can be accessed and downloaded without any issues. You can create a snapshot of the blob using the Azure portal, Azure CLI, or Azure PowerShell.

Alternatively, you can use the Azure Storage Explorer to download the blobs. Azure Storage Explorer allows you to download the blobs without modifying them, even if they have a retention policy applied.

Regarding the issue of blocked download in your existing storage account, it is difficult to determine the root cause without more information. However, you can try the following steps to troubleshoot the issue:

1. Check if the retention policy is applied correctly to the container and the blobs.
2. Check if there are any locks or access policies that are preventing the download operation.
3. Check if there are any issues with the network connectivity or firewall settings that are preventing the download operation.
4. Check if there are any issues with the client-side code or tool that is used for downloading the blobs.

If none of the above steps resolve the issue, you open a support ticket for further assistance.