Azure STT Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

Question

Azure STT Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

Steven Harris 6

Hi All,

I am using Post Recording Manager 4.1 (build 1086), 32 bit to perform .DCR to .RFT using Microsoft Azure Speech to Text Service and Azure Storage Account

Azure STT .DCR to .RTF is successful if I just use MS Azure Speech-to-text service:
Key
Region

However, if I also configure Post Recording Manager 4.1 to use Azure Storage with:
Account name
Account Key
Container name

The file is successfully uploaded to the blob container. However, the following errors are returned:

**Post Recording Manager 4.1 states:
Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]
**
"self": "https://australiaeast.api.cognitive.microsoft.com/speechtotext/transcriptions/GUID?api-version=2024-11-15",

    "displayName": "MyTranscriptionJob",

    "description": "STT job from PowerShell",

    "locale": "en-AU",

    "createdDateTime": "2025-09-02T04:47:30Z",

    "lastActionDateTime": "2025-09-02T04:47:56Z",

    "model": {

      "self": "https://australiaeast.api.cognitive.microsoft.com/speechtotext/models/base/GUID?api-version=2024-11-15"

    },

    "links": {

      "files": "https://australiaeast.api.cognitive.microsoft.com/speechtotext/transcriptions/GUID/files?api-version=2024-11-15"

    },

    "properties": {

      "wordLevelTimestampsEnabled": false,

      "displayFormWordLevelTimestampsEnabled": false,

      "channels": [

        0,

        1

      ],

      "punctuationMode": "DictatedAndAutomatic",

      "profanityFilterMode": "Masked",

      "error": {

        "code": "InvalidUri",

        "message": "Authentication failed for recordings URI."

      }

    },

    "status": "Failed"

Azure diagnostic log storage read report:
"statusCode": 403, AuthorizationFailure

"/subscriptions/GUID/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/sa_ause1/blobServices/default", "category": "StorageRead", "operationName": "GetBlobProperties", "operationVersion": "2021-10-04", "schemaVersion": "1.0", "statusCode": 403, "statusText": "AuthorizationFailure", "durationMs": 4, "callerIpAddress": "10.240.101.10:33216", "correlationId": "GUID", "identity": {"type":"SAS","tokenHash":"key1(),SasSignature()"}, "location": "australiaeast", "properties": {"accountName":"acc","userAgentHeader":"azsdk-net-Storage.Blobs/12.14.1 (.NET 8.0.18; CBL-Mariner/Linux)","clientRequestId":"","serviceType":"blob","objectKey":"/","metricResponseType":"AuthorizationError","serverLatencyMs":4,"requestHeaderSize":556,"responseHeaderSize":168,"tlsVersion":"TLS 1.3","sourceAccessTier":"Invalid"}, "uri": "https://sttcatlccprdause1.blob.core.windows.net:443/file?sp=r&se=2025-10-31T07%3A11%3A36Z&spr=https&sv=2021-08-06&sr=b&sig=XXXXX", "protocol": "HTTPS", "resourceType": "Microsoft.Storage/storageAccounts/blobServices"}

{ "time": "2025-10-24T07:11:26.2248291Z", "resourceId":

Any ideas on how to resolve would be appreciated.

Steve

Manas Mohanty 17,185 Reputation points Microsoft External Staff Moderator

2025-10-24T15:46:41.1166667+00:00
Hi Steven Harris

SAS token urls are not generated properly (missing list permission, It needs both read and listS). Below is remedial based on above error trace.

Cause (with trace)

Speech Batch Transcription is reading from a container, but your SAS is blob‑scoped (sr=b) and read‑only (sp=r). The service needs List + Read on the container.

Storage logs show statusCode: 403 AuthorizationFailure on GetBlobProperties for a URL ending with ?sp=r&sv=...&sr=b... → Speech returns InvalidUri: Authentication failed for recordings URI.

Remedy

1.Add Speech service as contributor to storage
2.Use the correct access pattern:

Container input (recommended):

Generate a container‑scoped SAS with Read + List: sr=c&sp=rl

Pass it as contentContainerUrl:
https://<account>.blob.core.windows.net/<container>?sv=...&sr=c&sp=rl&se=...&sig=...

Per‑file input:

Provide blob‑scoped SAS per file with Read: sr=b&sp=r in contentUrls.

Results container (if used):

Give write perms too (e.g., sr=c&sp=rlacw) so Speech can save outputs.

Virtual network / firewall

If the Storage account is restricted to selected networks, enable “Allow trusted Microsoft services” or use BYOS/managed identity for Speech to read blobs (no SAS in URL).

Avoid a private endpoint on the input container for SAS‑based ingestion; Speech fetches from outside your VNet and will 403/timeout.

Quick self‑check

A valid container SAS must succeed on:
https://<account>.blob.core.windows.net/<container>?restype=container&comp=list&sv=...&sr=c&sp=rl&se=...&sig=...
If this returns 403, regenerate SAS with sr=c + sp=rl.

Hope it helps.

Thank you.
Steven Harris 6 Reputation points

2025-10-25T02:35:45.7966667+00:00

Hi Manas, thank you for the reply.

RE: 1.Add Speech service as contributor to storage

Under network in the storage account “Allow trusted Microsoft services" is enabled**
**
There is a section under the blob container where customers generate a new SAS key for say 1-2 days:

Shared access signature (SAS) is a URI that grants restricted access to an Azure Storage container. Use it when you want to grant access to storage account resources for a specific time range without sharing your storage account key. Learn more about creating an account SAS

But we are using a shared storage account key.

I've configured
STTservice | Identity

Speech service | set system assigned status to 'on'
This added an object principle ID

Permissions
Azure role assignments

Subscription: speech service

Role
Storage Blob Data Contributor
Storage account resource type

<storage account>

Assigned to

speech service

Condition

None

However, the error persist.

Under the Storage account, Shared access signature, allow options are ticked. I generate a SAS and connection string. I don't know how if at all the application uses this information.

All I note is:

{ "time": "2025-10-25T02:17:48.6225971Z", "resourceId": "/subscriptions/GUID/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/SA/blobServices/default", "category": "StorageRead", "operationName": "GetBlobProperties", "operationVersion": "2021-10-04", "schemaVersion": "1.0", "statusCode": 403, "statusText": "AuthorizationFailure", "durationMs": 3, "callerIpAddress": "10.240.102.149:53534", "correlationId": "0755d881-101e-0026-5d55-4532ac000000", "identity": {"type":"SAS","tokenHash":"key1(),SasSignature()"}, "location": "australiaeast", "properties": {"accountName":"sttcatlccprdause1","userAgentHeader":"azsdk-net-Storage.Blobs/12.14.1 (.NET 8.0.18; CBL-Mariner/Linux)","clientRequestId":"Reqeust","serviceType":"blob","objectKey":"/","metricResponseType":"AuthorizationError","serverLatencyMs":3,"requestHeaderSize":552,"responseHeaderSize":168,"tlsVersion":"TLS 1.3","sourceAccessTier":"Invalid"}, "uri": "https://sttacc.blob.core.windows.net:443/sa/?sp=r&se=2025-11-01T02%3A17%3A47Z&spr=https&sv=2021-08-06&sr=b&sig=XXXXX", "protocol": "HTTPS", "resourceType": "Microsoft.Storage/storageAccounts/blobServices"}

1 answer

Your answer

Manas Mohanty 17,185 Reputation points Microsoft External Staff Moderator

2025-10-24T15:46:41.1166667+00:00

Hi Steven Harris

SAS token urls are not generated properly (missing list permission, It needs both read and listS). Below is remedial based on above error trace.

Cause (with trace)

Speech Batch Transcription is reading from a container, but your SAS is blob‑scoped (sr=b) and read‑only (sp=r). The service needs List + Read on the container.

Storage logs show statusCode: 403 AuthorizationFailure on GetBlobProperties for a URL ending with ?sp=r&sv=...&sr=b... → Speech returns InvalidUri: Authentication failed for recordings URI.

Remedy

1.Add Speech service as contributor to storage
2.Use the correct access pattern:

Container input (recommended):

Generate a container‑scoped SAS with Read + List: sr=c&sp=rl

Pass it as contentContainerUrl:
https://<account>.blob.core.windows.net/<container>?sv=...&sr=c&sp=rl&se=...&sig=...

Per‑file input:

Provide blob‑scoped SAS per file with Read: sr=b&sp=r in contentUrls.

Results container (if used):

Give write perms too (e.g., sr=c&sp=rlacw) so Speech can save outputs.

Virtual network / firewall

If the Storage account is restricted to selected networks, enable “Allow trusted Microsoft services” or use BYOS/managed identity for Speech to read blobs (no SAS in URL).

Avoid a private endpoint on the input container for SAS‑based ingestion; Speech fetches from outside your VNet and will 403/timeout.

Quick self‑check

A valid container SAS must succeed on:
https://<account>.blob.core.windows.net/<container>?restype=container&comp=list&sv=...&sr=c&sp=rl&se=...&sig=...
If this returns 403, regenerate SAS with sr=c + sp=rl.

Hope it helps.

Thank you.

Answer 1

Hi Manas,

Issue resolved via:

https://learn.microsoft.com/en-us/azure/ai-services/speech-service/bring-your-own-storage-speech-resource?tabs=portal

Go to the Azure portal and sign in to your Azure account.

Select the Storage account.

Select Access Control (IAM) menu in the left pane.

Select Add role assignment in the Grant access to this resource tile.

Select Storage Blob Data Contributor under Role and then select Next.

Select Managed identity under Members > Assign access to.

Assign the managed identity of your Speech resource and then select Review + assign.

After confirming the settings, select Review + assign.

{ "time": "2025-10-25T05:16:19.4490019Z", "resourceId": "/subscriptions/xyz/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/sttcatlccprdause1/blobServices/default", "category": "StorageRead", "operationName": "ListBlobs", "operationVersion": "2021-08-06", "schemaVersion": "1.0", "statusCode": 200, "statusText": "Success", "durationMs": 6, "callerIpAddress": "155.190.54.57:49950", "correlationId": "22fb8848-a01e-0051-396e-45e738000000", "identity": {"type":"AccountKey","tokenHash":"key1()"}, "location": "australiaeast", "properties": {"accountName":"stt","serviceType":"blob","objectKey":"/stt/sa,"metricResponseType":"Success","serverLatencyMs":6,"requestHeaderSize":364,"responseHeaderSize":152,"responseBodySize":1040,"tlsVersion":"TLS 1.3","sourceAccessTier":"Invalid"}, "uri": "https://stt.blob.core.windows.net:443/blob?restype=container&comp=list", "protocol": "HTTPS", "resourceType": "Microsoft.Storage/storageAccounts/blobServices"}

Manas Mohanty 17,185 Reputation points Microsoft External Staff Moderator

2025-10-27T10:58:10.4766667+00:00

Glad to hear that, Steven.

Share via

Azure STT Cloud processing failed. [InvalidUri, Authentication failed for recordings URI.]

1 answer

Your answer