I created a storage account last week verticaltbr . I have created 2 storage containers and uploaded the contents. But today I can't access these contents on Azure portal and Storage Explorer. I can, on the other hand, create new containers but can't access them. I've checked the Access Control (IAM) and it shows that I have the Contributor role. What's wrong here? What should I do to re-gain access?

Hi Adrian Yu , We request you first please check network and firewall settings. *** Verify that the virtual network and firewall rules are configured correctly on your storage account. Sometimes, network restrictions can block access .** * Temporarily set the storage account to allow access from all networks to see if this resolves the issue . *** Verify the assignment functions:** Double check that your user roles are configured correctly. Even if you have a Contributor role, specific permissions can be lost. Verify that the role is assigned the correct scope (e.g., storage account level). *** Signal Access Shared Signal (SAS):** If you are using Shared Access Signatures (SAS) for access, ensure that they are correctly configured and not expired . Check for hidden access roads that may affect your path. . These policies can override individual permissions **** Please Let me know if you need more help or if any of these.**

Lost access to data storage containers

Accepted answer

Keshavulu Dasari 1,155 Reputation points Microsoft Vendor

2024-09-09T18:40:55.2533333+00:00
Hi Adrian Yu,

We request you first please check network and firewall settings.

*** Verify that the virtual network and firewall rules are configured correctly on your storage account. Sometimes, network restrictions can block access.**

*Temporarily set the storage account to allow access from all networks to see if this resolves the issue.

*** Verify the assignment functions:**

Double check that your user roles are configured correctly. Even if you have a Contributor role, specific permissions can be lost. Verify that the role is assigned the correct scope (e.g., storage account level).

*** Signal Access Shared Signal (SAS):**

If you are using Shared Access Signatures (SAS) for access, ensure that they are correctly configured and not expired.

Check for hidden access roads that may affect your path. . These policies can override individual permissions

**** Please Let me know if you need more help or if any of these.**
Please sign in to rate this answer.
Adrian Yu 20 Reputation points Microsoft Employee

2024-09-10T01:41:45.6966667+00:00

Hi @Keshavulu Dasari ,

I've verified that my role is assigned at storage account level and this storage account is allowed to be accessed from all networks (see pic below). For SAS, I got this error "Authorization with Shared Key is disabled for this account. Any requests that are authorized with Shared Key, including shared access signatures (SAS), will be denied. "

Also, I don't have access to all the links you shared. How can I resolve this?

Adrian Yu 20 Reputation points Microsoft Employee

2024-09-10T01:45:23.9233333+00:00

Hi @Keshavulu Dasari ,

I've checked that I have the role assigned at storage account level. The storage account is enabled from all networks. But I don't have access. For SAS, I got this error message "Authorization with Shared Key is disabled for this account. Any requests that are authorized with Shared Key, including shared access signatures (SAS), will be denied. ".

What else should I do? And also I can't open any links you shared.

Adrian Yu 20 Reputation points Microsoft Employee

2024-09-10T01:46:02.3966667+00:00

I can't provide any comments.

Keshavulu Dasari 1,155 Reputation points Microsoft Vendor

2024-09-10T15:00:19.3266667+00:00

Hi Adrian Yu,

Shared Key authorization is disabled for your account. It means any requests, including those using Shared Access Signatures (SAS), that rely on Shared Key authorization will be denied. Enable Shared Key Authorization:

You can enable Shared Key authorization for your storage account if you need to use SAS tokens. This can be done through the Azure portal by navigating to your storage account settings and enabling the AllowSharedKeyAccess property.

Use Azure Active Directory (Azure AD) for Authorization:

Microsoft recommends using Azure AD for superior security. You can generate a User Delegation SAS which uses Azure AD credentials instead of Shared Key.

Check Your Network Settings:

Ensure that your network settings are correctly configured. From the image you provided, it seems that public network access is enabled for all networks, which is good. However, double-check other network settings to ensure there are no restrictions.

Review the SAS Token:

Make sure the SAS token is correctly formed and has the necessary permissions. Verify that the system time on the machine generating the SAS token is accurate, as significant time discrepancies can lead to authentication failures.

Once please Go through the below Link:

https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent

https://learn.microsoft.com/en-us/answers/questions/1459189/sas-token-not-working-when-accessing-storage-accou ** Please Let me know if you need more help or if any of these

Keshavulu Dasari 1,155 Reputation points Microsoft Vendor

2024-09-11T10:32:52.23+00:00

Hi Adrian Yu,
I Kindly Request Please 'Upvote'(Thumbs-up) and 'Accept' as an answer if the reply was helpful. This will also help us close this thread and acknowledge the time spent by community volunteers like us.
Thank you,

Adrian Yu 20 Reputation points Microsoft Employee

2024-09-11T12:38:58.6366667+00:00

Thank you! I have access now following your instructions.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Lost access to data storage containers

0 additional answers

Your answer