AuthorizationFailure error 403 when using private endpoint on storage account

Question

I have a storage account with proper private endpoint and dns configuration. Now, I am selecting disabled in networking, as I use org VPN and successfully can see the containers data. Other person is also using VPN, and facing an AuthorizationFailure 403 error. What could be the reason behind it? As there is a Private Endpoint on the storage account, the network setting should not block the traffic coming from VPN if I understood it correct, right? Could it be the role issue? I have storage account contributor, owner at subsription. The other person has storage blob data contributor, owner at subscription.

Answer 1

@Harshit Z Kothari

1.Verify that the VPN configuration is correct and that both of you can access other resources on the network without issues.
2. While the roles you both have should be sufficient, you could temporarily elevate the permissions to see if it resolves the issue, and then adjust them back to the appropriate level once resolved.
3.Check Azure Storage diagnostic logs for more detailed error messages that could provide insight into the problem. https://learn.microsoft.com/en-us/azure/storage/common/storage-analytics-logging or you can use Azure Storage logs in Azure Monitor (recommended solution for logging).

How long does the private DNS A record takes to be in effect? New or updated DNS zones and DNS records appear in the Azure DNS name servers within 60 seconds. For changes to existing records, DNS caching by DNS clients and DNS recursive resolvers outside of Azure DNS can affect timing. The cache duration is dependent on the Time-To-Live (TTL) property of each record set. Let me know if you are still seeing issues.