Home / Azure / Fix Azure Blob Upload 403 Forbidden

Azure

Fix Azure Blob Upload 403 Forbidden

Resolve Azure Blob Storage upload 403 errors by checking SAS tokens, IAM permissions, and storage account firewall settings.

Published: Apr 2, 20266 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

Azure Blob Storage returns 403 Forbidden when upload requests lack proper authorization. This can happen with SAS tokens, shared key authentication, or Azure AD role assignments, blocking applications from storing files.

Symptoms

403 Forbidden on upload:

```bash $ az storage blob upload --account-name mystorageaccount \ --container-name mycontainer \ --name test.txt \ --file test.txt

{"Message":"Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature."} ```

SAS token expired error:

```bash $ curl -X PUT "https://mystorageaccount.blob.core.windows.net/mycontainer/test.txt?sv=2023-01-03&ss=b&srt=sco&sp=w&se=2024-01-01T00:00:00Z&st=2024-01-01T00:00:00Z&spr=https&sig=SIGNATURE" \ -H "x-ms-blob-type: BlockBlob" \ --data-binary "@test.txt"

HTTP/1.1 403 Forbidden {"Message":"Signature did not match. String to sign used was..."} ```

Permission denied:

bash

# In application logs:
"Status: 403 (This request is not authorized to perform this operation)"

Common Causes

1.SAS token expired - Start and expiry time constraints
2.SAS permission mismatch - Token lacks write permission
3.IAM role missing - User/service principal lacks Storage Blob Data Contributor
4.Storage account firewall - Network rules blocking access
5.Public access disabled - Container requires authentication
6.Wrong storage key - Using old access key after rotation
7.CORS issues - Browser requests blocked

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check SAS Token Validity

```bash # Decode SAS token to check parameters # Look at the URL parameters: # sv: Storage version # se: Expiry time # st: Start time # sp: Permissions (should include 'w' for write)

# Check current time is within valid window date -u

# Compare with SAS token times (URL decoded) # se=2024-12-31T23:59:59Z (expiry) # st=2024-01-01T00:00:00Z (start) ```

Step 2: Generate New SAS Token

```bash # Generate new SAS token with write permission az storage container generate-sas \ --account-name mystorageaccount \ --name mycontainer \ --permissions w \ --expiry 2024-12-31T23:59:59Z \ --output tsv

# Generate with account key az storage account keys list \ --account-name mystorageaccount \ --query '[0].value' -o tsv ```

Step 3: Check IAM Role Assignments

```bash # Check current user's role assignments az role assignment list \ --assignee user@example.com \ --scope /subscriptions/SUB/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorageaccount

# Required roles for blob upload: # - Storage Blob Data Contributor (allows read/write/delete) # - Storage Blob Data Owner (full access)

# Assign missing role az role assignment create \ --assignee user@example.com \ --role "Storage Blob Data Contributor" \ --scope /subscriptions/SUB/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorageaccount ```

Step 4: Check Storage Account Firewall

```bash # Check network rules az storage account show \ --name mystorageaccount \ --resource-group my-rg \ --query '{Firewall:networkAcls}'

# If defaultAction is "Deny", only allowed IPs/subnets can access

# Add your IP to allowlist az storage account network-rule add \ --account-name mystorageaccount \ --ip-address YOUR_PUBLIC_IP

# Or allow all Azure services (use with caution) az storage account update \ --name mystorageaccount \ --resource-group my-rg \ --default-action Allow ```

Step 5: Verify Access Key

```bash # List storage account keys az storage account keys list \ --account-name mystorageaccount \ --resource-group my-rg

# Try upload with key az storage blob upload \ --account-name mystorageaccount \ --account-key KEY_VALUE \ --container-name mycontainer \ --name test.txt \ --file test.txt ```

Step 6: Check Public Access Setting

```bash # Check if public access is allowed az storage account show \ --name mystorageaccount \ --resource-group my-rg \ --query 'allowBlobPublicAccess'

# If false, anonymous access is blocked # For private containers, authentication is always required

# Enable public access (if needed) az storage account update \ --name mystorageaccount \ --resource-group my-rg \ --allow-blob-public-access true ```

Step 7: Test with Azure CLI

```bash # Authenticate with Azure AD az login

# Upload using AD authentication az storage blob upload \ --account-name mystorageaccount \ --container-name mycontainer \ --name test.txt \ --file test.txt \ --auth-mode login

# If this works, the issue is with your SAS token or access key ```

Step 8: Check Container ACL

```bash # Check container access level az storage container show \ --account-name mystorageaccount \ --name mycontainer \ --query '{PublicAccess:publicAccess,Metadata:metadata}'

# Possible values: # - container: Public read access for container and blobs # - blob: Public read access for blobs only # - null: No public access (requires authentication) ```

Step 9: Review Activity Logs

bash

# Check storage account activity logs for 403 errors
az monitor activity-log list \
  --resource-group my-rg \
  --caller user@example.com \
  --resource /subscriptions/SUB/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorageaccount \
  --query "[?contains(operationName.value, 'write')].{Time:eventTimestamp, Operation:operationName, Status:status.value}"

Step 10: Check for Conditional Access Policies

```bash # Check Azure AD conditional access policies # Azure Portal > Azure AD > Security > Conditional Access

# Look for policies that: # - Block storage access from certain locations # - Require MFA for storage access # - Restrict access to specific devices

# Policies may block access even with correct permissions ```

Azure Storage Authentication Methods

Method	Use Case	Permissions
Access Key	Service admin	Full access
SAS Token	Time-limited access	Scoped permissions
Azure AD RBAC	User/service principal	Role-based access
Managed Identity	Azure services	Automatic credential management

Verification

```bash # After fixing, test upload az storage blob upload \ --account-name mystorageaccount \ --container-name mycontainer \ --name verify.txt \ --file verify.txt \ --auth-mode login

# Verify blob exists az storage blob show \ --account-name mystorageaccount \ --container-name mycontainer \ --name verify.txt \ --query '{Name:name,Size:properties.contentLength}'

# Should return blob metadata ```

[Fix Azure Storage Account Inaccessible](/articles/fix-azure-storage-account-inaccessible)
[Fix Azure CORS Policy Blocking Calls](/articles/fix-azure-cors-policy-blocking-calls)
[Fix Azure SAS Token Invalid](/articles/fix-azure-sas-token-invalid)

[Technical troubleshooting: Fix Azure Aks Pod Crashloopbackoff Issue in Azure](azure-aks-pod-crashloopbackoff)
[Technical troubleshooting: Fix Azure Api Management Policy Expression Runtime](azure-api-management-policy-expression-runtime-error)
[Technical troubleshooting: Fix Azure App Configuration Feature Flag Not Refre](azure-app-configuration-feature-flag-not-refreshing)
[Technical troubleshooting: Fix Azure App Service 503 Always On Disabled Issue](azure-app-service-503-always-on-disabled)
[Technical troubleshooting: Fix Azure Application Gateway Err SSL Unrecognized](azure-application-gateway-err-ssl-unrecognized-name-alert)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

Azure Blob Upload 403 Forbidden Azure Blob Upload 403 Forbidden Azure Azure Blob Upload 403 Forbidden troubleshooting Azure Blob Upload 403 Forbidden fix Resolve Azure Blob Storage upload 403 errors by checking SAS tokens, IAM permissions, and storage account firewall settings Azure Resolve Azure Blob Storage upload 403 errors by checking SAS tokens, IAM permissions, and storage account firewall settings

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

Azure Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this azure-errors troubleshooting guide applies to my situation?

This guide is designed for azure-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these azure-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of azure-errors issue?

Most azure-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this azure-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for azure-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 2, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix Azure Blob Upload 403 Forbidden

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check SAS Token Validity

Step 2: Generate New SAS Token

Step 3: Check IAM Role Assignments

Step 4: Check Storage Account Firewall

Step 5: Verify Access Key

Step 6: Check Public Access Setting

Step 7: Test with Azure CLI

Step 8: Check Container ACL

Step 9: Review Activity Logs

Step 10: Check for Conditional Access Policies

Azure Storage Authentication Methods

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

Azure Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix Azure Blob Upload 403 Forbidden

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check SAS Token Validity

Step 2: Generate New SAS Token

Step 3: Check IAM Role Assignments

Step 4: Check Storage Account Firewall

Step 5: Verify Access Key

Step 6: Check Public Access Setting

Step 7: Test with Azure CLI

Step 8: Check Container ACL

Step 9: Review Activity Logs

Step 10: Check for Conditional Access Policies

Azure Storage Authentication Methods

Verification

Related Issues

Related Articles

People also search for

Share this guide

More Azure Troubleshooting Guides

Browse Guides from Other Categories

Azure Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading