SAS authentication to Third party Azure storage container

Question

Using Azure Virtual desktop and doing Shared Access Signature SAS authentication does not work to a 3rd party Azure storage container. IP is whitelisted. It originally was working but stopped.

Error getting from Azure storage explorer: "This request is not authorized to perform this operation." Getting the same error from AZ CLI.

Answer 1

We setup a Private Link this resolved the issue.   Since our VDI is in Azure reaching the blob of another subscription as still showing the private IP address, so the public IP whitelisting did not work.

Answer 2

It seems that you are encountering an authorization issue when trying to access a third-party Azure storage container using a Shared Access Signature (SAS). The error message "This request is not authorized to perform this operation" indicates that there may be a problem with the SAS token or its permissions.

Here are some common causes and solutions for this issue:

1. Expired Token: Ensure that the SAS token has not expired. If it has, generate a new SAS token with a future expiration time.
2. Missing Permissions: Check if the SAS token includes all the necessary permissions for the operation you are trying to perform. If permissions are missing, you will need to regenerate the SAS token with the correct permissions.
3. SAS Token Format: If you are manually constructing the SAS token, verify that it is well-formed and includes all required fields. Using official Azure SDKs or tools like Azure Storage Explorer can help avoid formatting errors.
4. Service vs Account SAS: Make sure you are using the appropriate type of SAS for your operation. For account-level operations, an Account SAS is required, while a Service SAS is needed for specific blob/container operations.
5. IP Address Whitelisting: Although you mentioned that the IP is whitelisted, double-check that the IP address from which you are making the request matches the whitelisted IP address in the storage account settings.
6. User Delegation SAS: If you are using a User Delegation SAS, ensure that the necessary fields and permissions are correctly set up.

If none of these solutions resolve the issue, consider reviewing the comprehensive diagnostic checklist for troubleshooting authorization errors in Azure Blob Storage.

---

References:

• Troubleshoot 403 errors in Azure Blob Storage
• Troubleshoot 403 errors in Azure Blob Storage