AuthorizationPermissionMismatch, HTTP error 403

Question

Hello Community,

I am trying to upload a file to Azure Storage -> Container with OAuth authorizations.

After following multiple blogs, I still cannot figure out what is missing. Similar error is resolved in by adding the roles but in my case it is not working.

I have below roles assigned to service principal, tried even with and without condition

But I am getting below error in POSTMAN

<?xml version="1.0" encoding="utf-8"?>
<Error>
    <Code>AuthorizationPermissionMismatch</Code>
    <Message>This request is not authorized to perform this operation using this permission.
RequestId:9c739c38-301e-0026-6f3d-6df30c000000
Time:2024-03-03T07:35:42.6451467Z</Message>
</Error>

When I tried the diagnostic in Azure portal, I am getting below notification. I am new to Azure and kind of out of options to fix this, can someone please assist?

Regards,

Pallab

Answer 1

Hello Pallab,

Greetings! Welcome to Microsoft Q&A Forum.

Based on the error message, It's permission issue. Please provide mentioned access for client_id = "xxxxxxxxxxxxxxxxxxxxxxx" ( IAM permission) please go into your storage account > IAM > Add role assignment and add the special permissions for this type of request. Other possible ways is due to the Wrong Storage Account Keys and/or Storage Account name or SAS Expired or Azure Storage Firewall has been configured and customer's IP/subnet has not been granted access. (You can also get a 403 error if the time on the server is not in sync with the time on storage servers.

Verify correct credentials:

• Ensure that the client ID you’re using has the necessary permissions. You mentioned that you’ve granted the Storage Blob Data Contributor role to the app, which is a good start.
• However, also verify that the app has the required permissions for the specific operation (PUT request in this case). Sometimes, it’s not just about the role but also about the specific permissions within that role.
• Go to your storage account in the Azure Portal, navigate to IAM (Identity and Access Management), and add the necessary permissions for your app.

Make sure that the Storage Account name is correct and has not been mistyped. The above error messages can also be seen if the Storage Account name is not correct.

Make sure you’re using the correct bearer token in your request. Double-check that the token you’re manually replacing is indeed the one obtained via Auth Code flow.

Also Enabling "Allow trusted Microsoft services to access this storage account" allows you to access storage account.

Ensure that you have _Contributor _and Blob Data Contributor permissions on the storage account.

Additional information: Assign an Azure role for access to blob data

Similar issue SO thread for reference - https://stackoverflow.com/questions/66525481/authorization-permission-mismatch-when-trying-to-put-a-file-in-azure-blob-with-a, https://stackoverflow.com/questions/72653133/status-403-code-authorizationfailure-message-this-request-is-not-authorized-t

And the above diagnostic in Azure portal, redirecting you to submit the issue details to create a azure support ticket.

Hope this answer helps!  Please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.