Azure File Share Upload file 403 Error

Nicole G 10

Hello, I have an azure file share and want wo upload files to it via a powershell in a runbook. I have a managed identity of this automation with storage blob data contributor and storage file data smb share contributor access on the file share. When I Start the runbook I always got 403 error. But when I enable Public Network access, it works. But I need to ensure enabled from selected virtualisierung Networks and IP Adresses. Can someone please help?

Keshavulu Dasari 765 Reputation points Microsoft Vendor

2024-10-16T19:17:00.1666667+00:00
Hi Nicole G,
Welcome to Microsoft Q&A Forum, thank you for posting your query here!
For this network configuration of your storage account related issue Please verify below once,

Verify IP Address Configuration:

Ensure that the IP addresses you want to allow are correctly added to the “Selected networks” list in the Networking settings of your storage account. You can do this in the Azure portal under the “Networking” section.

Check Firewall and Virtual Network Rules:

Make sure that the firewall and virtual network rules are configured properly. If the storage account is set to allow access only from selected networks, any IP address not explicitly allowed will be blocked.

Managed Identity Permissions:

Double-check that the managed identity used by your runbook has the necessary permissions at the correct scope. The roles Storage Blob Data Contributor and Storage File Data SMB Share Contributor should be assigned to the storage account or file share.

Secure Transfer Required Setting:

If the “Secure transfer required” setting is enabled on your storage account, ensure that your client supports SMB encryption. This setting can block unencrypted connections.

Testing with Azure Storage Explorer:

Use Azure Storage Explorer to manually upload files. This can help verify if the issue is specific to your runbook or a more general configuration problem.

Runbook Script Review:
Review your PowerShell script to ensure it correctly handles authentication and network settings. Sometimes, minor script adjustments can resolve access issues.

If these steps don’t resolve the issue, please share more details about your runbook script and any specific error messages you receive.
Nicole G 10 Reputation points

2024-10-16T19:23:40.3966667+00:00

Hi @Keshavulu Dasari my powershell in the runbook workspace, if I enable the access from all Public Networks. When I set this Option on ensble for selected IP, it doesn't work anymore
Keshavulu Dasari 765 Reputation points Microsoft Vendor

2024-10-16T20:07:21.7233333+00:00

Hi Nicole G,
If these steps don’t resolve the issue, please share more details about your runbook script and any specific error messages you receive. I’m happy to assist you further
Nicole G 10 Reputation points

2024-10-16T20:15:08.71+00:00

@Keshavulu Dasari does i need to configure the managed identity access to azure anywhere that in permission?
Keshavulu Dasari 765 Reputation points Microsoft Vendor

2024-10-17T11:48:51.0066667+00:00

Hi Nicole G,
Yes, you need to ensure that Managed Identity has the correct permissions configured in Azure. The basics to follow.
1. Assign roles to the managed identity: Login to the Azure portal, navigate to the resource (e.g., storage account) for which you want managed access, select Access control (IAM) from the left-hand menu, and click Add role assignment, Select the appropriate role (e.g., Storage Blob Data Contributor, Storage File Data SMB Share Contributor) and assign it to Managed Identity.
https://zcusa.951200.xyz/en-us/azure/role-based-access-control/role-assignments-portal-managed-identity
2. Verify the assignments: ensure that the required role is assigned to the appropriate location (e.g. member, object group, or specific object) of the managed identity. You can check this under the Role assignments section of the Identity tab of the managed identity

3. Network Configuration: Ensure that the network settings allow access to the IP address or virtual network where your runbook is running. The sources of the sources. For a level of security, consider using Azure Virtual Network service endpoints or private endpoints to connect to your storage account. This ensures that traffic is delivered properly within the Azure network.

By following these, you can set up a managed identity with the necessary permissions to avoid 403 errors and allow network access.

Please let us know if you have any further queries. I’m happy to assist you further.
Keshavulu Dasari 765 Reputation points Microsoft Vendor

2024-10-18T19:35:27.9066667+00:00

Hi Nicole G,
Checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be happy to help you
Nicole G 10 Reputation points

2024-10-19T08:20:00.7766667+00:00

@Keshavulu Dasari No the Response don't help me , because the Network config is still not clear to me and if I have to enable entra id service. Because everything is working finde, when I enable Public access from all networks
Keshavulu Dasari 765 Reputation points Microsoft Vendor

2024-10-19T15:51:51.8233333+00:00
Hi Nicole G,
To ensure your Azure File Share works with selected virtual networks and IP addresses without enabling public access from all networks.

Steps to Configure Network Access for Azure File Share

Configure Virtual Network and Subnet:

Ensure your Azure Automation account is in a virtual network. If not, create a virtual network and subnet in the Azure portal.

Create a Private Endpoint:

Navigate to your storage account in the Azure portal.

Go to Networking and select Private endpoint connections.

Click on + Private endpoint to create a new private endpoint for your storage account. This will allow access to your file share from within your virtual network.

Configure DNS:

If you create a private endpoint, you might need to configure a private DNS zone to resolve the storage account’s private endpoint. This ensures that the private endpoint is correctly resolved within your virtual network.

Enable Service Endpoints:

Alternatively, you can use service endpoints. Go to your virtual network, select the subnet, and enable the Microsoft.Storage service endpoint. This allows the subnet to access the storage account securely.

Update Storage Account Firewall Settings:

In the storage account, go to Networking.

Under Firewalls and virtual networks, select Selected networks.

Add your virtual network and any specific IP addresses that need access.

Verify Managed Identity Permissions:

Ensure the managed identity has the necessary roles (Storage Blob Data Contributor and Storage File Data SMB Share Contributor) assigned at the storage account level.

Enabling Entra ID (Azure AD) Integration

If you need to use Azure AD (now Microsoft Entra ID) for authentication, ensure the following:

Enable Azure AD Domain Services:

If your organization uses Azure AD Domain Services, ensure it is configured correctly, and your virtual network is linked to it.

Assign Azure AD Roles:

Assign the necessary Azure AD roles to the managed identity. This can be done in the Azure AD section of the Azure portal.

Additional Information:

For more detailed steps and examples, you can refer to the official Microsoft documentation on Azure Files networking considerations and configuring network endpoints. https://zcusa.951200.xyz/en-us/azure/storage/files/storage-files-networking-overview https://zcusa.951200.xyz/en-us/azure/storage/files/storage-files-networking-endpoints

If you follow these steps, you should be able to configure your Azure File Share to work with selected virtual networks and IP addresses without needing to enable public access from all networks

Share via

Azure File Share Upload file 403 Error

Your answer