The error "Operation returned an invalid status code 'Unauthorized'" when registering a server endpoint and installing the agent usually indicates that the request to Azure is failing due to authentication or permission issues.

Question

The error "Operation returned an invalid status code 'Unauthorized'" when registering a server endpoint and installing the agent usually indicates that the request to Azure is failing due to authentication or permission issues.

Yasar Shaikh 140

The error "Operation returned an invalid status code 'Unauthorized'" when registering a server endpoint and installing the agent usually indicates that the request to Azure is failing due to authentication or permission issues.

NOTE -I have de-registered this server (an Azure File Sync agent) from one Storage Sync Service and re-register it with a new one (which can be connected to a different storage account and file share).

Performed Trouble shooting

I have owner access

The Azure File Sync agent is compatible with the OS ( Win2016) version.

Reinstalled agent

Please help.

Nandamuri Pranay Teja 3,610 Reputation points Microsoft External Staff Moderator

2025-05-27T08:04:48.6+00:00
Hello Yasar,

Thank you for your question!

Adding to below answer provided by Alex Burlachenko

Below are the steps to add contributor" or "storage file data smb share contributor

Navigate to your Storage Sync Service in the Azure portal. Under "Settings," look for "Identity."

Ensure "System assigned" managed identity is On.

Crucially, verify that this managed identity has at least "Contributor" permissions (or "Storage Sync Contributor") on the storage account you are trying to sync with. Even though you have Owner, the service principal needs these direct permissions.

Post which Navigate to "Access control (IAM)."Click "Add" -> "Add role assignment."

Search for the "Storage Sync Contributor" role (or "Contributor" if that's not available).

Assign this role to your Storage Sync Service (select "Managed identity" under "Assign access to," then find your Storage Sync Service).

Even if you're on Azure, internal network configurations or even local server firewalls can sometimes block the necessary communication. The agent needs to communicate with specific Azure endpoints for registration and sync. Ensure no firewalls (Windows Defender Firewall, network security groups, network virtual appliances) are blocking outbound traffic on ports 80, 443, and potentially others.

Before re-installing, consider a more thorough cleanup:

Uninstall the agent through "Add or Remove Programs."

Manually check for and delete the installation directory (usually C:\Program Files\Azure\StorageSyncAgent). Use regedit to check for and remove any relevant Azure File Sync registry keys. (Be extremely careful when editing the registry and back it up first). Keys are typically found under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Azure\StorageSync.

Restart the server.

Then, try installing the agent again.

In the Azure File Sync agent registration UI, sign out of the current account and sign back in to refresh the authentication token. If possible, try registering with another account that has equivalent permissions to rule out user-specific issues. Ensure the new Storage Sync Service is in the same Azure region as the storage account (Azure File Sync requires regional alignment). Verify that the storage account and file share are accessible and not locked or restricted by policies (e.g., Azure RBAC or network rules).

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Up-Vote” wherever the information provided helps you, this can be beneficial to other community members.
Yasar Shaikh 140 Reputation points

2025-05-27T10:15:18.6133333+00:00

Thanks for quick reply and support.

Accepted answer

0 additional answers

Your answer

Yasar Shaikh 140 Reputation points

2025-05-27T10:15:18.6133333+00:00

Thanks for quick reply and support.

Answer 1

Hi Yasar Shaikh,

thanks so much for posting that on the q&a, appreciate you taking the time to set out all the details.

even if u do have owner access at subscription level, the sync service could still throw out this error if the managed identity lacks proper permissions.

be sure that the managed identity of the storage sync service has "contributor" or "storage file data smb share contributor" role on the storage account that you're syncing to. owner rights sometimes don't propagate down correctly, so this is not uncommon. here's the ms doc on azure file sync roles: assign access permissions.

next, make sure the server's registration has not hung in a strange half-state. try running unregister-azstoragesyncserver in powershell (admin mode!!!) to clean out the remnants, then register again. often the previous registration haunts u even after you're convinced it's gone. further reading here: unregister server.

in addition to that, when u reinstalled the agent, please ensure u used the latest release from the microsoft download center. outdated agents will freak out with newer apis. download it fresh here: download azure file sync agent.

lastly if u've switched to a different storage account, check that the new one has network rules to accept traffic from the sync service. "unauthorized" errors are a favorite of misconfigs even if perms are set correctly. look at the "networking" tab of the storage account in the azure portal and see if it's not blocking u. Set up the network rules and virtual networks.

hope that helps! if you’re still stuck, send me the exact powershell error log (the -debug output is pure gold), and I’ll investigate deeper.

good luck ))
Alex
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment
https://ctrlaltdel.blog/

Yasar Shaikh 140 Reputation points

2025-05-27T10:15:27.9666667+00:00

Thanks for quick reply and support.

Share via

The error "Operation returned an invalid status code 'Unauthorized'" when registering a server endpoint and installing the agent usually indicates that the request to Azure is failing due to authentication or permission issues.

0 additional answers

Your answer