I own the AI Foundry account but cannot access blob storage.

Question

I own the AI Foundry account but cannot access blob storage.

Omar Morris 0 Microsoft Employee

I am the owner of the account. I created an Azure AI Foundry hub and project. I created a few prompt flows. After a day or two, I am unable to access the blob storage account associated with the hub. I have added myself to the Storage Account as a Storage Blob Contributor, but I still can't access the storage account. This is incredibly frustrating that as the account owner and creator I can't access the assets that belong to the hub/project and there isn't clear documentation that addresses this issue.

55659036 5 Reputation points

2025-03-06T20:38:58.1333333+00:00

I had to turn on system assigned managed Identity for the AI service. I was then able to use RBAC to assign the storage blob data contributor role to the managed identity.
Hari Babu Vattepally 3,345 Reputation points Microsoft External Staff Moderator

2025-03-07T07:47:47.3266667+00:00
Hi @Omar Morris,

Firstly, apologies for delay in response.

I understand that you are facing access issue with the blob storage associated with your Azure AI foundry hub despite being the owner and having added yourself as a storage blob contributor role.

Azure role assignments may take some time to propagate. If you have recently assigned yourself as a "Storage Blob Contributor," the permissions might not be effective yet. Please wait for a few minutes to an hour and try again.

Make sure the blob storage has the correct permissions for your hub to access it. The hub's managed identity should be assigned to the Blob Storage Reader role for the blob.

it is essential to ensure that your user account is assigned the "Storage Blob Data Contributor/Owner" role for the relevant storage account. While having "Contributor" level access provides certain permissions, it does not automatically grant the necessary permissions for blob storage operations.

Please follow these steps to assign the required role:

Navigate to the Azure portal and select the appropriate storage account.

In the left-hand menu, select Access Control (IAM).

Click on + Add, then select Add role assignment.

In the search box, type "Storage Blob Data Owner" and select the role.

Assign this role to your user account or to the identity associated with your Document Translator resource.

The Data Owner role provides full access to manage data, including setting permissions.

Also, check if Storage account uses a private endpoint, if it enabled. Please make sure that it is allowing access to your storage account. Check and find that your IP address or virtual network is allowed access.

However, check that your hub also has access to blob storage account that was created outside of the hub, you might need to explicitly grant permissions.

References:

Role-based access control in Azure AI Foundry portal

Troubleshoot problems during creation of a data labeling project

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Omar Morris 0 Reputation points Microsoft Employee

2025-03-08T22:28:22.7+00:00

How do I turn on system managed identity? And when creating the hub should I choose credential or identity based?
Omar Morris 0 Reputation points Microsoft Employee

2025-03-11T21:08:05.15+00:00

This did not work.
Hari Babu Vattepally 3,345 Reputation points Microsoft External Staff Moderator

2025-03-17T10:32:56.5333333+00:00

Hi @Omar Morris,

Apologies for delay response. We are sorry to see that the above solution didn't work for you.

I suggest you to please follow the below to get this issue fixed.

By default, hubs are assigned a system-managed identity and please follow as shown below.

As shown in the below screen shot, please navigate to the AI Hub and select as per below accordingly if you are using shared keys to access the storage account and save.

Once it is updated, Assign users with the Storage Blob Data Contributor and Storage File Data Privileged Contributor roles in Azure role-based access control for the storage account. If they only need read access, use the Storage Blob Data Reader and Storage File Data Privileged Reader roles. For more information, visit the role assignments resource in this document.

And, if you would like to work with a storage account that has disabled shared key access, you may need to assign additional roles to your users or the managed identity for your hub. By default, hubs have a system-assigned managed identity, but certain scenarios might necessitate a user-assigned managed identity as below.

This table summarizes the scenarios that require extra role assignments:

ScenarioMicrosoft Entra IDRequired rolesNotesAI SpeechStorage Blob Data ContributorStorage File Data Privileged ContributorAI SpeechStorage Blob Data Contributor Storage File Data Privileged ContributorModel-as-a-Servicesystem-assigned managed identityStorage Blob Data ContributorThe hub's managed identity. Automatically assigned the role when provisioned. Don't manually change this role assignment.Azure Searchsystem-assigned managed identityStorage Blob Data ContributorThe hub's managed identity. Automatically assigned the role when provisioned. Don't manually change this role assignment.Fine tuning of OSS modelsUser-assigned managed identityStorage Blob Data ContributorPromptFlowUser's identityStorage Blob Data Contributor Storage File Data Privileged ContributorAdd and manage your own dataUser's identityStorage Blob Data ContributorI hope by following the will help in resolving the issue.

Please let us know in the comments sections if the issue is resolved or still persists. We will be glad to assist you with the further resolution.

Please do reconsider to UPVOTE the survey, wherever the information provided helps you, this can be beneficial to other community members.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-17T10:36:14.28+00:00

Hi Omar Morris

Can you able to access the associated storage account manually?

Storage accounts -> <Your associated storage account with the hub> -> Container -> files

If no, please paste the error message here.
Hari Babu Vattepally 3,345 Reputation points Microsoft External Staff Moderator

2025-03-18T14:07:43.06+00:00

Hi Omar Morris,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hari Babu Vattepally 3,345 Reputation points Microsoft External Staff Moderator

2025-03-19T10:56:00.2433333+00:00

Hi Omar Morris,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Please let us know in the comments sections if the issue is resolved or still persists. We will be glad to assist you with the further resolution.

Please do reconsider to UPVOTE the survey, wherever the information provided helps you, this can be beneficial to other community members.

Your answer

55659036 5 Reputation points

2025-03-06T20:38:58.1333333+00:00

I had to turn on system assigned managed Identity for the AI service. I was then able to use RBAC to assign the storage blob data contributor role to the managed identity.
Omar Morris 0 Reputation points Microsoft Employee

2025-03-08T22:28:22.7+00:00

How do I turn on system managed identity? And when creating the hub should I choose credential or identity based?
Omar Morris 0 Reputation points Microsoft Employee

2025-03-11T21:08:05.15+00:00

This did not work.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-17T10:36:14.28+00:00

Hi Omar Morris

Can you able to access the associated storage account manually?

Storage accounts -> <Your associated storage account with the hub> -> Container -> files

If no, please paste the error message here.
Hari Babu Vattepally 3,345 Reputation points Microsoft External Staff Moderator

2025-03-18T14:07:43.06+00:00

Hi Omar Morris,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hari Babu Vattepally 3,345 Reputation points Microsoft External Staff Moderator

2025-03-19T10:56:00.2433333+00:00

Hi Omar Morris,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Please let us know in the comments sections if the issue is resolved or still persists. We will be glad to assist you with the further resolution.

Please do reconsider to UPVOTE the survey, wherever the information provided helps you, this can be beneficial to other community members.

Share via

I own the AI Foundry account but cannot access blob storage.

Your answer