Azure Blob File is not readable With the URL from Azure Blob Storage with Microsoft Entra ID as Authentication Method.

Question

The blob in the Container Data Storage is not accessible with the URL given in the Blob Properties if the Authentication Method as Microsoft Entra User Account and Access Level is "Private"

It is showing "Resource Not Found" Error.

It is Working With Access Key [Shared Access Signature]. Can you please guide how to Access the blob file with Microsoft Entra User Account?

Answer 1

@ABHISHEK KUMAR Thanks for posting your query on Microsoft Q&A.

To access blob data in the Azure portal with Microsoft Entra credentials, a user must have the following role assignments:

• A data access role, such as Storage Blob Data Reader or Storage Blob Data Contributor
• Additionally, the Azure Resource Manager Reader role, at a minimum, scoped at storage account or higher.

You can check the role assignments by going to Azure Portal -> your storage account -> Access control (IAM)

Keep in mind the following points about Azure role assignments in Azure Storage:

• When you create an Azure Storage account, you aren't automatically assigned permissions to access data via Microsoft Entra ID. You must explicitly assign yourself an Azure role for Azure Storage. You can assign it at the level of your subscription, resource group, storage account, or container.
• When you assign roles or remove role assignments, it can take up to 10 minutes for changes to take effect.
• Built-in roles with data actions can be assigned at management group scope. However, in rare scenarios there might be a significant delay (up to 12 hours) before data action permissions are effective for certain resource types. Permissions will eventually be applied. For built-in roles with data actions, adding or removing role assignments at management group scope is not recommended for scenarios where timely permission activation or revocation, such as Microsoft Entra Privileged Identity Management (PIM), is required.
• If the storage account is locked with an Azure Resource Manager read-only lock, then the lock prevents the assignment of Azure roles that are scoped to the storage account or a container.
• If you set the appropriate allow permissions to access data via Microsoft Entra ID and are unable to access the data, for example you're getting an "AuthorizationPermissionMismatch" error. Be sure to allow enough time for the permissions changes you made in Microsoft Entra ID to replicate, and be sure that you don't have any deny assignments that block your access, see Understand Azure deny assignments.

Please refer to the following documents for more information:

• Assign an Azure role for access to blob data
• Authorize access to blobs using Microsoft Entra ID
• Choose how to authorize access to blob data in the Azure portal

Older SO post: https://stackoverflow.com/questions/55352689/access-a-blob-file-via-uri-over-a-web-browser-using-new-aad-based-access-control

If you are still stuck, let me know in the comments and I can investigate further.