Function App host storage account shared key access disabled issues.

Question

Hi,

Please help on the below issue.

Recently I set "disabled" on my host storage account Property "Allow storage account key access" as part S360 issue fix but Function app which is running in Standard plan stopped working.

Storage account and function app both are running in the same region (Cental US).

Network firewall is set to "Enabled from all networks" in the host storage account and did all the necessary app settings in the function app to support managed identity but still getting the 403 error: 

Status: 403 (This request is not authorized to perform this operation using this permission.) ErrorCode: AuthorizationPermissionMismatch

Storage account Network setting:

FunctionApp Network settings:

 

Thank you,

Siva

Answer 1

Hello SivaD,

Thanks for your question.

This is an IAM issue, not a networking one.

Check the permissions on the service principal or managed identity being used.

Go to Storage account > IAM > Add role assignment.

In 'Add Role Assignment', select these two roles and assign it to the account or identity connecting.

• Storage Blob Data Contributor
• Storage Queue Data Contributor https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal#determine-resource-scope

Regards,

You can mark it 'Accept Answer' if this helped you