Issue with Synapse Linked Service and Storage Blob Data Contributor Role

Question

Issue with Synapse Linked Service and Storage Blob Data Contributor Role

Nguyen Luong 0

Hi,

I’m encountering an issue when trying to open the Synapse Linked Service that was automatically created by Azure Data Lake Storage. The error message I’m receiving is:

“Please check permission on ... to make sure you have at least 'Storage Blob Data Contributor' role for the storage account '...'. If your access was recently granted, please refresh your credentials.”

Even though I have assigned the Storage Blob Data Contributor role for the storage account and refreshed the credentials several times, the issue persists. (See attached pictures for details.)

Screenshot 2024-10-17 at 1.32.20 AM

Screenshot 2024-10-17 at 12.52.57 AM

Has anyone else faced this problem or know how to resolve it? Any help or insights would be greatly appreciated!

Thank you!

Nguyen Luong 0 Reputation points

2024-10-18T05:43:07.79+00:00

I have already added the Storage Blob Data Contributor permission for the Synapse workspace, but the error still persists. You can check the photo
Nehruji R 8,186 Reputation points Microsoft External Staff Moderator

2024-10-23T09:40:36.26+00:00

Nguyen Luong, The Authorization Failed Error encountered by a user with the Storage Blob Data Contributor role is due to missing necessary permissions at the storage account level. This error occurs even though there are no firewall rules for the storage account and no recent changes to the user's roles or permissions.

To fix this, check the permissions at the account level and ensure that the necessary permissions are granted. Users with Management plane roles, such as creating accounts and managing settings, do not have access to data operations. Conversely, data plane roles, like Storage Blob Data Owner, allow access to data operations such as uploading and downloading data but not management operations.

For more information on RBAC roles and their functionalities, refer to this documentation: Azure Built-in Role Descriptions.

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please accept and "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.
Nehruji R 8,186 Reputation points Microsoft External Staff Moderator

2024-10-25T09:47:59.7566667+00:00

Hi, we hope the provided answer helped if yes please accept the answer else, please let us know if you have any further queries. I’m happy to assist you further.
Nehruji R 8,186 Reputation points Microsoft External Staff Moderator

2024-10-29T12:15:27.45+00:00

Hi, we hope the provided answer helped if yes please accept the answer else, please let us know if you have any further queries. I’m happy to assist you further.

1 answer

Your answer

Nguyen Luong 0 Reputation points

2024-10-18T05:43:07.79+00:00

I have already added the Storage Blob Data Contributor permission for the Synapse workspace, but the error still persists. You can check the photo
Nehruji R 8,186 Reputation points Microsoft External Staff Moderator

2024-10-23T09:40:36.26+00:00

Nguyen Luong, The Authorization Failed Error encountered by a user with the Storage Blob Data Contributor role is due to missing necessary permissions at the storage account level. This error occurs even though there are no firewall rules for the storage account and no recent changes to the user's roles or permissions.

To fix this, check the permissions at the account level and ensure that the necessary permissions are granted. Users with Management plane roles, such as creating accounts and managing settings, do not have access to data operations. Conversely, data plane roles, like Storage Blob Data Owner, allow access to data operations such as uploading and downloading data but not management operations.

For more information on RBAC roles and their functionalities, refer to this documentation: Azure Built-in Role Descriptions.

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please accept and "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.
Nehruji R 8,186 Reputation points Microsoft External Staff Moderator

2024-10-25T09:47:59.7566667+00:00

Hi, we hope the provided answer helped if yes please accept the answer else, please let us know if you have any further queries. I’m happy to assist you further.
Nehruji R 8,186 Reputation points Microsoft External Staff Moderator

2024-10-29T12:15:27.45+00:00

Hi, we hope the provided answer helped if yes please accept the answer else, please let us know if you have any further queries. I’m happy to assist you further.

Answer 1

Hello Nguyen Luong,

Greetings! Welcome to Microsoft Q&A Platform.

The error you are encountering indicates that the request being made from your notebook or pipeline is not authorized to perform the operation with the given permission. There could be a few reasons for this:

Double-check the permissions assigned to the service principal being used by your notebook or pipeline. Ensure that it has the necessary permissions.

Synapse notebooks use Azure Active Directory (Azure AD) pass-through to access the ADLS Gen2 accounts. If you are running the notebook directly on the synapse, your account needs Storage Blob Data Contributor to access the ADLS Gen2 account (or folder).

If you are running the notebook via the pipeline, the synapse workspace managed service identity needs Storage Blob Data Contributor to access the ADLS Gen2 account (or folder).

Please check if you provided the storage blob data contributor access

Similar thread for reference - https://learn.microsoft.com/en-us/answers/questions/1489213/storage-blob-data-contributor-role-and-synapse-ana

https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/using-the-workspace-msi-to-authenticate-a-synapse-notebook-when/ba-p/2330029

Troubleshooting docs for reference - https://learn.microsoft.com/en-us/azure/data-factory/connector-troubleshoot-azure-data-lake, https://learn.microsoft.com/en-us/power-apps/maker/data-platform/azure-synapse-link-data-lake

Hope this information helps! Please let us know if you have any queries to further help with more details.

Share via

Issue with Synapse Linked Service and Storage Blob Data Contributor Role

1 answer

Your answer