Cannot access container in a Storage account

Question

Cannot access container in a Storage account

aliasmrchips 31

I am trying to follow this quickstart: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal

However, after creating the container, I can't navigate to it in order to upload a blob.

In particular, I get an error saying "This request is not authorized to perform this operation."

Yusuf Demir 10 Reputation points

2024-03-11T14:14:28.2433333+00:00

Error when accessing datastore: Unable to access data because it does not exist, is behind a virtual network, or you do not have Storage Blob Data Reader role on this storage account.

I am trying to connect to the blob storage that I created and own via the azure ai studio playground. it is giving the above error. it used work 2 weeks ago. what is wron here...

For networking , it is enabled from all networks...

Accepted answer

2 additional answers

Your answer

Yusuf Demir 10 Reputation points

2024-03-11T14:14:28.2433333+00:00

Error when accessing datastore: Unable to access data because it does not exist, is behind a virtual network, or you do not have Storage Blob Data Reader role on this storage account.

I am trying to connect to the blob storage that I created and own via the azure ai studio playground. it is giving the above error. it used work 2 weeks ago. what is wron here...

For networking , it is enabled from all networks...

Answer 1

shiva patpi 13,366 Microsoft Employee Moderator

Hello @aliasmrchips ,
Just to confirm your issue was due to the Firewall of the storage account.

On the Azure Portal you saw for your storage account Firewall was enabled.
(Storage Account -> Networking -> Allow Access from "Selected Networks")

To resolve the issue: You have selected "All Networks".

I just summarized here in the answer section , so that you can "Accept this answer" it will help community out there .

Yusuf Demir 10 Reputation points

2024-03-11T14:17:15.2366667+00:00

no it is not about the firewall.. see the above posted issue by me please. issue persists.

Answer 2

Melo, Carmo 16

add the storage direct "Reader" for that user

Shawn Collins 0 Reputation points

2023-10-04T11:39:14.61+00:00

this worked. thanks. It's weird that u need "Reader" when I already had them as "Data Owner".

Answer 3

shiva patpi 13,366 Microsoft Employee Moderator

Hello @aliasmrchips ,
Thanks for your query , some times this might happen due to in-sufficient privileges'

Can you try adding below role for that storage account ?

Steps:

Browse to Storage Account in the Azure Portal
Access Control (IAM)
Grant Access to this resource section (Add Role Assignments)
Role: Storage Blob Data Contributor
Assign Access to: Use the default values (I.e. User , Group , or Service Principal)
Select: User Name
Save

Kindly let us know if those steps help you out in resolving the issue and don't forget to "Accept the Answer".

aliasmrchips 31 Reputation points

2021-02-18T00:35:25.977+00:00

I am the owner, which seems like it should be sufficient. I tried adding myself to the container, to the storage account and to the subscription as a Contributor and a Storage Blob Data Contributor, all to no effect. I also tried logging out and back in and using the Microsoft Azure Storage Explorer application.
shiva patpi 13,366 Reputation points Microsoft Employee Moderator

2021-02-18T02:03:15.883+00:00

Hello @aliasmrchips ,
More significantly , did you add role Storage Blob Data Contributor at the storage account level ? (Not to the container level).

Also just make sure to double check there is no firewall for that storage account (Storage Account -> Networking -> Allow Access from "All networks")
aliasmrchips 31 Reputation points

2021-02-18T03:41:00.607+00:00

The firewall was the problem. Thanks!
aliasmrchips 31 Reputation points

2021-02-18T03:43:01.213+00:00

I don't see an option to accept the answer that was actually the answer, but would be glad to do so.
AMBATI, PRAVEEN 1 Reputation point

2021-07-29T20:58:26.07+00:00

In our case we should not enable "All Networks" as It is vulnerability.

FYI - I have provided Storage Blob Data Contributor permissions to Virtual Machine/Service Principal/My user. But No Luck :(
VENKATA BONDELA 1 Reputation point

2021-09-15T11:35:39.027+00:00

this works. Thanks
Amit Thore 41 Reputation points

2025-02-20T10:44:29.2233333+00:00
@shiva patpi i have written code for user Delegation sas which is generating token and able to access blobs from storage , but my setting is allowed from all networks . i have to make setting as "Selected ip and networks". as working on microsoft KPI - i want to disable my access key and use user delegation sas. i need code with explanation for this. below code is generating my sas uri

BlobClient blobClient = blobServiceClient

**.GetBlobContainerClient("development")** **.GetBlobClient(StorageHelper.GetTopStorageFolder(p) + "/" + thumbFileName);**

Uri blobSASURI = await StorageHelper.CreateUserDelegationSASBlob(blobClient, delegationKey);

// Create a blob client object with SAS authorization

BlobClient blobClientSAS = new BlobClient(blobSASURI);

Share via

Cannot access container in a Storage account

2 additional answers

Your answer