AzCopy copy fails – RESPONSE Status : 403 This request is not authorized to perform this operation using this permission



Hello Friends,

Hope you all are doing good !!! πŸ™‚ .

In our previous article we have discussed about, how to configure and use AzCopy too . Today in this article we will discuss how to address one issue we experienced during our work with AzCopy tool.

Previous Azure series :

  1. Learn Basics Of Azure Networking In 60 Hours
  2. Learn Basic Of Azure Active Directory And Azure Identity And Access Management
  3. Azure DevOps – Learn at one place

If you have missed our previous articles on Azure Storage and Database Series, please check it in following links.

Issue Details :

Azcopy is a great command-line tool for automating Azure storage, it is a simple yet powerful command line interface that allows you to copy files to and from Azure storage and between Azure storage accounts. In my last lab exercise, I was working with AzCopy tool. As we had to upload and download files from local drive to my Azure blob and vice verse. In that exercise we have successfully downloaded AzCopy tool for my windows workstation also successfully login to my subscription. Then I had to upload a file to my Azure blob container by using the following command.

azcopy copy “C:\Users\moharman\Desktop\Rasmita.pdf” “https://kj21storageacount.blob.core.windows.net/kj-container/AzCopy Authorization.png”

Figure 1 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Uploading

After few second I received a big error message, like RESPONSE Status : 403 This request is not authorized to perform this operation using this permission . Following is the details of the error message.

C:\MANAS DATA\AZURE\Azure_AZ-104\Azure Storage And Database Services\AZCopy\azcopy_windows_amd64_10.10.0>azcopy copy “C:\Users\moharman\Desktop\Rasmita.pdf” “https://kj21storageacount.blob.core.windows.net/kj-container/AzCopy Authorization.png”
INFO: Scanning…
INFO: Authenticating to destination using Azure AD
INFO: Any empty folders will not be processed, because source and/or destination doesn’t have full folder support

Job 69e09361-c4d3-b749-76da-a3759042812f has started
Log file is located at: C:\Users\moharman.azcopy\69e09361-c4d3-b749-76da-a3759042812f.log

INFO: Authentication failed, it is either not correct, or expired, or does not have the correct permission -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, /home/vsts/go/pkg/mod/github.com/!azure/azure-storage-blob-go@v0.10.1-0.20210407023846-16cf969ec1c3/azblob/zc_storage_error.go:42
===== RESPONSE ERROR (ServiceCode=AuthorizationPermissionMismatch) =====
Description=This request is not authorized to perform this operation using this permission.
RequestId:5188f336-801e-0071-0f7b-5fdab4000000
Time:2021-06-12T11:13:14.4715278Z, Details:
Code: AuthorizationPermissionMismatch
PUT https://kj21storageacount.blob.core.windows.net/kj-container/AzCopy%20Authorization.png?timeout=901
Authorization: REDACTED
Content-Length: [34020]
User-Agent: [AzCopy/10.10.0 Azure-Storage/0.13 (go1.15; Windows_NT)]
X-Ms-Blob-Cache-Control: []
X-Ms-Blob-Content-Disposition: []
X-Ms-Blob-Content-Encoding: []
X-Ms-Blob-Content-Language: []
X-Ms-Blob-Content-Md5: []
X-Ms-Blob-Content-Type: [application/pdf]
X-Ms-Blob-Type: [BlockBlob]
X-Ms-Client-Request-Id: [d8fa9da3-9a77-45fa-6aa8-6e292ba36080]
X-Ms-Version: [2019-12-12]


RESPONSE Status: 403 This request is not authorized to perform this operation using this permission.
Content-Length: [279]
Content-Type: [application/xml]
Date: [Sat, 12 Jun 2021 11:13:13 GMT]
Server: [Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0]
X-Ms-Client-Request-Id: [d8fa9da3-9a77-45fa-6aa8-6e292ba36080]
X-Ms-Error-Code: [AuthorizationPermissionMismatch]
X-Ms-Request-Id: [5188f336-801e-0071-0f7b-5fdab4000000]
X-Ms-Version: [2019-12-12]

Figure 2 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Issue

As we can see the issue seems to be related to permissions. As I was writing an article on AzCopy tool, I knew that, the user must have at least one of the following role assignment to upload a new blob.

  • Storage Blob Data Contributor
  • Storage Blob Data Owner

The identity/account I was using has full access with all administrator roles assignment and owner roles assignment for the subscription and even I have configured the storage account and blob container using the same identity . So I was under impression that without the above role assignment I could upload the files but I was completely wrong. Also i came across with one article where it stated that, “Unlike most other areas in Azure the permissions of Owner don’t implicitly give you access to these β€˜lower level’ permissions”.

Then I decided to assign one of the above role assignment to this account and for that I quickly move to my Storage Account (we can choose particular container also) => Access control (IAM) => Select Role Assignment Tab as showing in the following figure.

Figure 3 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Add Role Assignment

And added one of the required role assignment as showing in the following figure.

Figure 4 – Microsoft Azure Storage and Database – Blob Service – AzCopy- AzCopy- Add Role Assignment

Now we have all required permission. When I re-run the command to upload file from my local drive to my azure container, it successfully uploaded my file as we can see in the following figures.

Figure 5 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Uploaded
Figure 6 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Uploaded

I hope this is informative to you. Please let me know if I missed anything important or if my understanding is not up to the mark.

Keep reading, share your thoughts, experiences. Feel free to contact us to discuss more.

If you have any suggestion / feedback / doubt, you are most welcome. Stay tuned on Knowledge-Junction, will come up with more such articles.

Thanks for reading πŸ™‚ .

Manas Ranjan Moharana

Around 11+ years of total IT experience and since last 10 years working on almost on all version of SharePoint .Interested in learning and sharing something new to be helthy.

You may also like...

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: