I own the AI Foundry account but cannot access blob storage.

Omar Morris 0 Microsoft Employee

I am the owner of the account. I created an Azure AI Foundry hub and project. I created a few prompt flows. After a day or two, I am unable to access the blob storage account associated with the hub. I have added myself to the Storage Account as a Storage Blob Contributor, but I still can't access the storage account. This is incredibly frustrating that as the account owner and creator I can't access the assets that belong to the hub/project and there isn't clear documentation that addresses this issue.

Hari Babu Vattepally 1,740 Reputation points Microsoft External Staff

2025-03-07T07:47:47.3266667+00:00
Hi @Omar Morris,

Firstly, apologies for delay in response.

I understand that you are facing access issue with the blob storage associated with your Azure AI foundry hub despite being the owner and having added yourself as a storage blob contributor role.

Azure role assignments may take some time to propagate. If you have recently assigned yourself as a "Storage Blob Contributor," the permissions might not be effective yet. Please wait for a few minutes to an hour and try again.

Make sure the blob storage has the correct permissions for your hub to access it. The hub's managed identity should be assigned to the Blob Storage Reader role for the blob.

it is essential to ensure that your user account is assigned the "Storage Blob Data Contributor/Owner" role for the relevant storage account. While having "Contributor" level access provides certain permissions, it does not automatically grant the necessary permissions for blob storage operations.

Please follow these steps to assign the required role:

Navigate to the Azure portal and select the appropriate storage account.

In the left-hand menu, select Access Control (IAM).

Click on + Add, then select Add role assignment.

In the search box, type "Storage Blob Data Owner" and select the role.

Assign this role to your user account or to the identity associated with your Document Translator resource.

The Data Owner role provides full access to manage data, including setting permissions.

Also, check if Storage account uses a private endpoint, if it enabled. Please make sure that it is allowing access to your storage account. Check and find that your IP address or virtual network is allowed access.

However, check that your hub also has access to blob storage account that was created outside of the hub, you might need to explicitly grant permissions.

References:

Role-based access control in Azure AI Foundry portal

Troubleshoot problems during creation of a data labeling project

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Omar Morris 0 Reputation points Microsoft Employee

2025-03-11T21:08:05.15+00:00

This did not work.

1 answer

55659036 0 Reputation points

2025-03-06T20:38:58.1333333+00:00

I had to turn on system assigned managed Identity for the AI service. I was then able to use RBAC to assign the storage blob data contributor role to the managed identity.
Please sign in to rate this answer.
Omar Morris 0 Reputation points Microsoft Employee

2025-03-08T22:28:22.7+00:00

How do I turn on system managed identity? And when creating the hub should I choose credential or identity based?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

I own the AI Foundry account but cannot access blob storage.

1 answer

Your answer