Prerequisites
-
Access to the Azure Portal
-
Required permissions to assign roles on the Storage Account
-
Service Principal created in Microsoft Entra ID
Steps to assign role:
-
Sign in to the Azure Portal. Go to the target Storage Account.
-
Select Access Control (IAM) from the left navigation pane. Click + Add, then select Add role assignment.
-
In the Role tab, select Storage Blob Data Reader. And click Next.
-
Under Assign access to, select User, group, or service principal.
-
Select the required Service Principal.
-
Click Review + Assign to complete the role assignment.
Role details: Storage Blob Data Reader, provides read-only access to containers and blob data within the Storage Account.
Verification: Allow 1–5 minutes for Azure RBAC propagation before validating access.
Network access permissions
Access to ADLS depends on both identity-based permissions and network access settings.
- If the Storage Account is configured to allow access from Selected networks, ensure that the required IP addresses, virtual networks (VNets), or subnets are added to the allowlist.
- If Public network access is disabled, configure the required network access (such as approved VNets, subnets, or private connectivity) before attempting to connect.
- If the Agent is deployed in a partner or external network, that network must also be explicitly allowed by the Storage Account network configuration.