Error: (InvalidDocumentAccessLevel): Cannot access source document location with the current permissions. Azure Translator service

Question

I have setup translator service and granted 'Storage blob contributor' access to both source and target storage containers using managed identity.

Still, I am getting this error:

Error: (InvalidDocumentAccessLevel): Cannot access source document location with the current permissions.

This is the code below:

source_container_path = (f"https://{storage_container}.dfs.core.windows.net/{source_container}/{file_name}")
            target_container_path = (f"https://{storage_container}.dfs.core.windows.net/{target_container}/{file_name}")

            logger.info("Source container path: '%s'", source_container_path)

            translation_input = DocumentTranslationInput(
                source_url = source_container_path,
                storage_type = StorageInputType.FILE,
                targets=[
                    TranslationTarget(
                        target_url=target_container_path,
                        language="en" 
                    )
                ]
            )

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

Ensure that the Translator service's managed identity has the Storage Blob Data Reader role for the source container and Storage Blob Data Contributor role for the target container.

If you're using a SAS token for access, ensure it has the correct permissions and hasn't expired.

As a test, try using a simpler path structure without subfolders to rule out any issues with folder permissions.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful

Answer 2

Hi Ridhima Nagar

Welcome to Microsoft Q&A Forum and thanks for posting your query here!

The error message you’re encountering, “Cannot access source document location with the current permissions,” typically indicates that the Azure Translator service is unable to access the blob in your Azure Storage account due to insufficient permissions.

Please note that if you’ve disallowed public access to your storage account, all requests to blob data must be authorized regardless of the container’s public access setting. Even if you’ve allowed anonymous read access to the container, the Translator service might still need explicit authorization if public access is disallowed at the storage account level.

Power Automate and Power Apps does not support connection with Azure Blob storage if the Blob storage is behind the firewall.

Please try to set public access at the storage account level.

Before you can use the Translator V3 connector's operations for document translation, you must grant your Translator resource access to your storage account using a managed identity with role-based identity control (RBAC).

Or else you may use the Azure Translator service with a SAS URL to access the blob in the Azure Storage. https://stackoverflow.com/questions/77066290/cannot-access-source-document-location-with-the-current-permissions

For reference: https://learn.microsoft.com/en-us/azure/ai-services/translator/connector/document-translation-flow?tabs=blob-storage#translate-documents

You may also try the instructions for Document Translation using the Python Client Library. Here's another sample. I would recommend that you generate a new SAS token and pay close attention to the Start and Expiry date and time or else with REST API.

Hope this Helps!

If your issue remains unresolved or have further questions, please let us know in the comments how we can assist. We are here to help you and strive to make your experience better and greatly value your feedback.

---

Please do "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.