Can't access AML Notebooks

Question

Can't access AML Notebooks

Yeliz Kilinc 0 Microsoft Employee

When I open the AML Workspace and click "notebooks", I get this error "You do not have access to the workspace storage account. The storage account may be behind a VNET. Contact your administrator if this error persists.". I can see samples but not my files. I believe it can't access the blob storage but which roles should I give ? I gave my user and managed identity of AML relevant permissions but it still doesn't work.

Nathan Roberts (SN) 9,106 Reputation points Volunteer Moderator

2025-12-29T19:46:11.83+00:00
Hey there, Yeliz Kilinc

I am just learning myself with AML, so my comment may not be that helpful, but will give it a try.

Have you got the following roles assigned to your account:

Storage blob data Owner or Storage blob data reader (depending on it's use),

Storage blob data contributor,

Reader,

Contributor

You may need to go to the storage account and apply the permissions there too.

Hope this helps,
Nathan
SRILAKSHMI C 12,520 Reputation points Microsoft External Staff Moderator

2025-12-30T09:17:52.6133333+00:00
Hello Yeliz Kilinc,

Welcome to Microsoft Q&A and Thank you for reaching out.

This error indicates that Azure ML Notebooks cannot access the workspace’s default storage account. This is a data-plane permission or network access issue, not a problem with the AML workspace itself.

Why this happens

The Notebooks experience reads and writes files directly to the default Blob Storage account associated with the AML workspace. If the user or the AML managed identity does not have sufficient Blob data permissions, notebooks will fail to load—even though the workspace and samples may still be visible.

This commonly occurs when:

Only control-plane roles (Contributor / Owner) were assigned

The storage account is behind a VNET / private endpoint

Blob data roles are missing

Required role assignments

Assign these roles on the Storage Account (or the specific Blob container):

For your user account, Storage Blob Data Contributor (required to read/write notebooks)

For the Azure ML workspace managed identity, Storage Blob Data Contributor

Important Roles such as Reader, Contributor, or Storage Account Contributor alone are not sufficient. Azure ML Notebooks require Blob Data-plane access.

Please Check network (VNET) configuration

Since the error mentions VNET restrictions, verify the following:

If the storage account uses a private endpoint

The AML workspace must be deployed into the same VNET, or

Private DNS resolution must be correctly configured

Firewall settings

If public network access is restricted:

Allow trusted Microsoft services, or

Explicitly allow the AML workspace subnet

After assigning roles, allow 5–10 minutes for RBAC propagation

Sign out and sign back in to the Azure portal before retrying

You do not need:

Storage Blob Data Owner (unless managing permissions) Reader/Contributor roles on the storage account for notebook access

Please refer this Azure ML access control

AML workspace storage requirements

Azure Blob data access roles

I Hope this helps. Do let me know if you have any further queries.

Thank you!
Yeliz Kilinc 0 Reputation points Microsoft Employee

2025-12-30T15:01:59.7033333+00:00

Hello @SRILAKSHMI C , I've already given the Storage Blob Contributor role for my user and managed identity of AML. I allowed public networking as well but it still gives the same error.
Manas Mohanty 13,440 Reputation points Microsoft External Staff Moderator

2026-01-06T10:01:44.2866667+00:00
Hi Yeliz Kilinc

Thank you for connecting on call.

Putting Observation for record.

There was not VNET scenarios in your case.

Issue persisted after adding "Storage blob contributor/reader" role for Azure ML workspace managed identity.

Issue persisted after using Azure AI account owner role on Workspace.

I saw this "KeyBasedAuthenticationNotPermitted" in the HAR trace provided from you.

Could you please enable Keybased authentication from UI or CLI with below command and let me know if it fixes the issue

az storage account update \ --name <storage-account-name> \ --resource-group <resource-group-name> \ --allow-shared-key-access true

Thank you.
Manas Mohanty 13,440 Reputation points Microsoft External Staff Moderator

2026-01-07T05:58:32.03+00:00
Hey Yeliz Kilinc

Thank you for sharing the HAR traces. Keeping the observation for record here too.

Saw below error in HAR trace.

KeyBasedAuthenticationNotPermitted

Please enable the Key access back from UI or CLI and let us know.

Tested and working CLI command

az storage account update --name testagent4968872020 --resource-group JanTestRG --allow-shared-key-access true

Thank you for collaborating.

1 answer

Your answer

Nathan Roberts (SN) 9,106 Reputation points Volunteer Moderator

2025-12-29T19:46:11.83+00:00

Hey there, Yeliz Kilinc

I am just learning myself with AML, so my comment may not be that helpful, but will give it a try.

Have you got the following roles assigned to your account:

Storage blob data Owner or Storage blob data reader (depending on it's use),

Storage blob data contributor,

Reader,

Contributor

You may need to go to the storage account and apply the permissions there too.

Hope this helps,
Nathan
Yeliz Kilinc 0 Reputation points Microsoft Employee

2025-12-30T15:01:59.7033333+00:00

Hello @SRILAKSHMI C , I've already given the Storage Blob Contributor role for my user and managed identity of AML. I allowed public networking as well but it still gives the same error.
Manas Mohanty 13,440 Reputation points Microsoft External Staff Moderator

2026-01-06T10:01:44.2866667+00:00

Hi Yeliz Kilinc

Thank you for connecting on call.

Putting Observation for record.

There was not VNET scenarios in your case.

Issue persisted after adding "Storage blob contributor/reader" role for Azure ML workspace managed identity.

Issue persisted after using Azure AI account owner role on Workspace.

I saw this "KeyBasedAuthenticationNotPermitted" in the HAR trace provided from you.

Could you please enable Keybased authentication from UI or CLI with below command and let me know if it fixes the issue

az storage account update \ --name <storage-account-name> \ --resource-group <resource-group-name> \ --allow-shared-key-access true

Thank you.
Manas Mohanty 13,440 Reputation points Microsoft External Staff Moderator

2026-01-07T05:58:32.03+00:00

Hey Yeliz Kilinc

Thank you for sharing the HAR traces. Keeping the observation for record here too.

Saw below error in HAR trace.

KeyBasedAuthenticationNotPermitted

Please enable the Key access back from UI or CLI and let us know.

Tested and working CLI command

az storage account update --name testagent4968872020 --resource-group JanTestRG --allow-shared-key-access true

Thank you for collaborating.

Answer 1

Hey Yeliz Kilinc

Thank you for the confirming the constraint on using "Keybased" authentication.

I was able to replicate the scenario after disabling key based authentication.

Solution is to use Jupiter notebook or VS code web/desktop from computes with manage identity permission to storage.

Attached steps to use managed identity authentication for other using looking answer on same context.

Compute Instance has MI enabled (System‑assigned MI is fine). Workspace and compute MI(s) have Storage RBAC:
Storage Blob Data Contributor and reader (or Reader if strictly read‑only) on the workspace storage account scope.
Goto Data in AML studio then locate Default blob store. on the Default Datastores, turn off “Save credentials with the datastore for data access” and turn on “Use workspace managed identity for data preview and profiling.
Check "Enabled Managed Identity for SMB" on Storage configuration with "Key based authentication" disabled.

If you found the pointers in answer helpful, please don't forget to accept this answer as verified one.

Thank you for collaborating.

Share via

Can't access AML Notebooks

1 answer

Your answer