Good morning, am unable to connect from my databricks notebook to one particular container in my storage account, as i am able to connect to other containers in the storage account. I did a comparison of the permissions they look the same, unmount and re-mount the end point, still getting same error see error that i get below: Error in SQL statement: AbfsRestOperationException: Operation failed: "This request is not authorized to perform this operation using this permission.", 403, HEAD, https://heiaepng001dwestalnda01.dfs.core.windows.net/hr-lnd/hr_data_users/_spark_metadata?upn=false&action=getStatus&timeout=90 com.databricks.backend.common.rpc.SparkDriverExceptions$SQLExecutionException: Operation failed: "This request is not authorized to perform this operation using this permission.", 403, HEAD, https://heiaepng001dwestalnda01.dfs.core.windows.net/hr-lnd/hr_data_users/_spark_metadata?upn=false&action=getStatus&timeout=90 at shaded.databricks.azurebfs.org.apache.hadoop.fs.azurebfs.services.AbfsRestOperation.completeExecute(AbfsRestOperation.java:300)

Hi , Please Add the RBAC Storage Blob Data Contributor to the user that is running the notebook, or your user and if using MI, please make sure that it has above RBAC role on storage account Steps here: https://docs.microsoft.com/en-us/azure/synapse-analytics/security/how-to-grant-workspace-managed-ide... (Grant permissions to managed identity after workspace creation) And After performing above steps , please make sure that particular container authentication method is set using Microsoft Entra user account Please check this , if it helps, please accept answer , Thanks

UNABLE TO CONNECT FROM DATABRICKS TO AZURE CONTAINER

Accepted answer

Deepanshukatara-6769 8,715 Reputation points

2024-03-04T08:37:32.91+00:00

Hi ,

Please Add the RBAC Storage Blob Data Contributor to the user that is running the notebook, or your user and if using MI, please make sure that it has above RBAC role on storage account

Steps here: https://docs.microsoft.com/en-us/azure/synapse-analytics/security/how-to-grant-workspace-managed-ide... (Grant permissions to managed identity after workspace creation)

And After performing above steps , please make sure that particular container authentication method is set using Microsoft Entra user account

Please check this , if it helps, please accept answer , Thanks
Please sign in to rate this answer.

1 person found this answer helpful.
Osamwonyi Alekwe 40 Reputation points

2024-03-04T09:02:13.06+00:00

it has the RBAC Storage Blob Data Contributor already and the authentication method is set to :Microsoft Entra user account, see screen shot :

Osamwonyi Alekwe 40 Reputation points

2024-03-04T09:03:04.56+00:00

see screen shot

Osamwonyi Alekwe 40 Reputation points

2024-03-04T09:04:36.03+00:00

Osamwonyi Alekwe 40 Reputation points

2024-03-04T09:06:23.7033333+00:00

Deepanshukatara-6769 8,715 Reputation points

2024-03-04T09:16:34.44+00:00

Ok I think this is a ADLS account , if it is ,so you need to also manage ACL for a particular container in ADLS , please follow the doc for this https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-acl-azure-portal

Osamwonyi Alekwe 40 Reputation points

2024-03-04T09:26:25.8733333+00:00

I have, but still get same error:

Deepanshukatara-6769 8,715 Reputation points

2024-03-04T09:32:15.57+00:00

I think this is for a container, If you are granting permissions by using only ACLs then to grant a security principal read or write access to a file, you'll need to give the security principal Execute permissions to the root folder of the container, and to each folder in the hierarchy of folders that lead to the file, so in the case RWX execute permission to be given till the file of the container

Deepanshukatara-6769 8,715 Reputation points

2024-03-04T09:32:33.55+00:00

Link for ref --> https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control#how-to-set-acls

Osamwonyi Alekwe 40 Reputation points

2024-03-04T09:38:21.28+00:00

the root folder already has same permission, its inherited

Deepanshukatara-6769 8,715 Reputation points

2024-03-04T10:13:03.2066667+00:00

So access is good its maybe what you are try to fetch, I think you are performing some get from metadata of container using adf , to let you know the metadata properties mentioned in the public document are only retrievable at the moment by a Get metadata activity. Moreover , The maximum size of returned metadata is 4 MB.

Please check https://learn.microsoft.com/en-us/azure/data-factory/control-flow-get-metadata-activity#supported-connectors

If still issue , request you to raise a Support request with Azure using portal

Osamwonyi Alekwe 40 Reputation points

2024-03-04T13:15:57.9833333+00:00

"I think this is for a container, If you are granting permissions by using only ACLs then to grant a security principal read or write access to a file, you'll need to give the security principal Execute permissions to the root folder of the container, and to each folder in the hierarchy of folders that lead to the file, so in the case RWX execute permission to be given till the file of the container"

this worked for me

Deepanshukatara-6769 8,715 Reputation points

2024-03-04T14:04:27.7766667+00:00

Ok Osam , Great that I could help you , request you to please accept answer to help our community , Thanks!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

UNABLE TO CONNECT FROM DATABRICKS TO AZURE CONTAINER

0 additional answers

Your answer