Azure Blob Storage — authentication failed with 403

Azure Blob Storage returns 403 because the SAS token expired, the storage key changed, or the managed identity lacks the Storage Blob Data Reader role.

intermediatedebuggingazurestorage

Symptoms

error: 403 Server failed to authenticate the request
The connection works locally but fails in production
SAS token works for read but not write

Possible causes

The SAS token expired or has insufficient permissions
The storage account key was rotated but the app uses the old key
The managed identity does not have the required RBAC role

Diagnosis steps

Check the SAS token expiry

echo $SAS_TOKEN | base64 -d | jq .se

Interpretation

The se field shows the expiry time; if past, the token is invalid.

Verify managed identity roles

az role assignment list --assignee $PRINCIPAL_ID

Interpretation

Confirm the identity has Storage Blob Data Contributor for write access.

Root cause

The credentials used to authenticate the request are invalid, expired, or lack the required RBAC role, so Azure rejects the operation with 403.

Fix

Generate a new SAS token with sufficient permissions, rotate the app to use the new storage key, or assign the required RBAC role to the managed identity.

Verify the fix

Retry the blob operation and confirm it succeeds; verify the old credentials are rejected.

Symptom walkthrough

Azure Blob Storage returns 403 because the SAS token expired, the storage key changed, or the managed identity lacks the Storage Blob Data Reader role. The error appears in production but may not surface in local development because the conditions that trigger it depend on the deployment environment or runtime configuration. Understanding the full symptom set helps distinguish this issue from similar errors.

Diagnosis in practice

Follow the diagnosis steps in the frontmatter to isolate the cause. Each step includes a command and an interpretation of the output. The goal is to narrow down whether the issue is in the configuration, the runtime, or the application code. Reproduce the error in a minimal setup before applying a fix.

Root cause

The credentials used to authenticate the request are invalid, expired, or lack the required RBAC role, so Azure rejects the operation with 403.

Fix

Generate a new SAS token with sufficient permissions, rotate the app to use the new storage key, or assign the required RBAC role to the managed identity. After applying the fix, monitor the system to confirm the error does not recur under load or in different environments.

Verification

Retry the blob operation and confirm it succeeds; verify the old credentials are rejected. If the verification passes, the fix is confirmed; if not, re-examine the diagnosis steps for missed contributing factors.

Diagnostic commands

Run these commands to reproduce and diagnose the issue:

echo $SAS_TOKEN | base64 -d | jq .se
az role assignment list --assignee $PRINCIPAL_ID