Unable to create Storage Container Access Policies

Question

Hi,

I'm trying to create a Stored Access policy and Immutable Blob Storage policy within several containers but I consistently get the error: "Failed to update storage container '<name>'. Error: The account being accessed does not have sufficient permissions to execute this operation."

I have the following role assignments on the container:

• Owner
• Storage Blob Data Contributor
• Storage Blob Data Owner
• User Access Administrator

How can I get these policies in place?

Thanks,

Dean

Answer 1

Hi @ Dean Ferley,

Welcome to Microsoft Q&A Platform.

As discussed during the call, you are attempting to create an access policy for the container named $logs, which is created by default.

For this system-generated container, customization options such as configuring access policies are not supported, as it is reserved for logging purposes.

You can configure access policies only for containers that are manually created

If you encounter the error “Failed to update storage container” while creating a Stored Access Policy or configuring an Immutable Blob Storage policy,

Please note that although the assigned RBAC roles may be sufficient, the issue may not be related to permissions.

There could be other causes. Please verify the following:

• Check the Storage Account firewall settings.
• If you are accessing the storage account over the public network, ensure that Public network access is enabled.
• If access is restricted to specific IP addresses or virtual networks, select Selected virtual networks and IP addresses and make sure your public IP address is added

Please enable the Allow storage account key access at the configurations.

You can also check the Activity log for the error: Failed to update storage container '<name>'.

Alternatively Could you please try creating it using Azure CLI commands. If you receive any errors, please share the error screenshot via private message.

Note: If you have multiple subscriptions, make sure you are logged into the correct subscription.

If the storage account has ‘Allow storage account key access’ set to Disabled and you attempt to use key-based authentication, the operation will fail.

As stated in Prevent Shared Key authorization for an Azure Storage account

When you disallow Shared Key authorization for a storage account, Azure Storage rejects all subsequent requests to that account that are authorized with the account access keys. Only secured requests that are authorized with Microsoft Entra ID will succeed.

Ref: Authorize access to data in Azure Storage

Azure CLI: az storage container policy create

az storage container policy list --container-name--account-key  --account-name --auth-mode {key}  --blob-endpoint --connection-string --lease-id

Azure CLI: Configure a retention policy on a container

az storage container immutability-policy create --resource-group <resource-group> --account-name <storage-account> --container-name <container> --period 10

Pleaseand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.