I have built a script for a resource HealthCheck, however i encountered an authorize error issue. For context I have two storage accounts, one public for UAT and one private for production. I have set up a user assigned managed identity for the same identity across multiple Azure resources and assigned permissions for both storage account SMB file share contributors. I can retrieve information from the UAT storage account but receive an authorization error when retrieving from production. Could this be a networking issue? The error message is shown below.

Hi, Welcome to MS Q&A Network Restrictions : Verify if the production storage account has any network restrictions. If it is configured to allow access only from specific virtual networks or IP addresses, ensure that the requests are coming from an allowed network. Also make sure Allow Azure services on the trusted services list to access this storage account and Microsoft network routing . kindly accept answer if it helps Please let us know if any further questions Thanks Deepanshu

Authorization Error When Retrieving File share Information From Storage Account

Accepted answer

Deepanshu katara 12,960 Reputation points

2024-07-03T06:03:53.7166667+00:00
Hi, Welcome to MS Q&A

Network Restrictions:

Verify if the production storage account has any network restrictions. If it is configured to allow access only from specific virtual networks or IP addresses, ensure that the requests are coming from an allowed network. Also make sure Allow Azure services on the trusted services list to access this storage account and Microsoft network routing.

kindly accept answer if it helps

Please let us know if any further questions

Thanks

Deepanshu
Please sign in to rate this answer.
ElroyTong-7850 45 Reputation points

2024-07-03T08:12:53.0166667+00:00

Hi @Deepanshukatara-6769
My storage account already has it enabled but it still has the authorization error

ElroyTong-7850 45 Reputation points

2024-07-03T08:15:17.28+00:00

Here are the permission i set for my manage identity

Deepanshu katara 12,960 Reputation points

2024-07-03T08:16:33.8633333+00:00

Hi ELory , did you check networking restrictions, did it worked?

Deepanshu katara 12,960 Reputation points

2024-07-03T08:19:21.0166667+00:00

As I see you have a private storage account for production so you need to add/select your private network section in to the networking of prod storage account as show in above image

And you can check this doc for more ref https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

ElroyTong-7850 45 Reputation points

2024-07-03T08:23:12.68+00:00

My ip address has been allowed access by the firewall

Deepanshu katara 12,960 Reputation points

2024-07-03T08:26:43.19+00:00

Ok so are you running script from your local ?, can you please share the image of your networking section?

ElroyTong-7850 45 Reputation points

2024-07-03T08:30:48.5966667+00:00

yes running in local , for runbook in automation account

Deepanshu katara 12,960 Reputation points

2024-07-03T08:36:07.4633333+00:00

Ok so can you please verify once whether we are using private endpoints for prod storage accounts?, go to networking section then click on private endpoints and then you can check this

Please Check Image

ElroyTong-7850 45 Reputation points

2024-07-03T08:36:09.3666667+00:00

yes private end point is enabled

Deepanshu katara 12,960 Reputation points

2024-07-03T08:39:48.1166667+00:00

So basically you cannot do this from your local , you need to to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

Please check this https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

ElroyTong-7850 45 Reputation points

2024-07-03T08:53:47.9033333+00:00

does that mean for it to work for my runbook in automation account i have to find the private endpoint ip address and add it in firewall for it to work

Deepanshu katara 12,960 Reputation points

2024-07-03T09:36:50.04+00:00

Ok so to explain to configure private access between an Azure automation account and Storage Account.

Please note that Private EndPoint can only be used to provide inbound traffic (connect to) to a PaaS Service

It cannot provide outbound access from the PaaS Service.

Meaning, the PaaS service should rely on it's Public IP or list of outbound Public IPs (for some PaaS) to make external calls.

Now, in your scenario, I see you would like to use your Automation account to connect to a Private IP (Private IP of the Storage Account Private EndPoint)

In this case, you must consider using Automation Hybrid Runbook Worker on a VM in the same VNET as the Private EndPoint

Then, this VM will be able to access the private IP of the storage Account's Private EndPoint

More details can be found here.

ElroyTong-7850 45 Reputation points

2024-07-03T09:58:56.43+00:00

Thank you for the clarification

Deepanshu katara 12,960 Reputation points

2024-07-03T10:03:16.49+00:00

It was my pleasure , Thanks!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Authorization Error When Retrieving File share Information From Storage Account

0 additional answers

Your answer