Cloud witness and blob storage

Question

I have two VM on Azure in a vnet . and a blob storage as a cloud witness.
on the cloud witness , it allow the vnet of the vm and allow the service endpoint . already .

however it still failed to use the blob account as cloud witness and have the error

"The request is not authorized to perform this operation"

any thing is missed ?

Answer 1

Hello @sakuraime ,
Thanks for your query ! This error happens if you don't have the right authorization to access the storage account.
From where that storage account is being accessed ? Is that from those VMs you are getting error ?
If you are trying to access outside of the VNET you will get that error message.
Since you have selected , Allow access from "Selected Networks" , In the firewall section try to add your ClientIP address
(or)
Try to debug by removing "Selected Networks".

Check out the below article w.r.t Azure Storage firewalls and virtual networks , how it works and alternate ways.
https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

One of the important Note from the above article

"Turning on firewall rules for your storage account blocks incoming requests for data by default, unless the requests originate from a service operating within an Azure Virtual Network (VNet) or from allowed public IP addresses. Requests that are blocked include those from other Azure services, from the Azure portal, from logging and metrics services, and so on.
You can grant access to Azure services that operate from within a VNet by allowing traffic from the subnet hosting the service instance. You can also enable a limited number of scenarios through the exceptions mechanism described below. To access data from the storage account through the Azure portal, you would need to be on a machine within the trusted boundary (either IP or VNet) that you set up."