Video Indexer cannot access Storage ACcount

Hi Mauricio Rojas,

We've encountered this issue before with a customer using Azure Video Indexer alongside a Storage Account and a User Assigned Managed Identity. In that case, even though the Managed Identity was assigned the Storage Blob Data Contributor role, they still received the "StorageAccessDenied" error when attempting to index videos.

To resolve it, we first checked to ensure that the role assignment had fully propagated, as sometimes Azure permissions can take a few minutes to apply. We also confirmed that the correct Managed Identity was assigned to the Storage Blob Data Contributor role on the appropriate Storage Account. Any mismatch in these details could lead to access issues.

In some cases, restrictive access policies on the Storage Account were the cause, so we verified there were no IP restrictions, network rules, or private endpoints preventing Video Indexer access. Similarly, the firewall settings on the Storage Account were reviewed to make sure they allowed necessary service access. If the firewall was set to "Selected networks," adding the appropriate network resolved the issue.

Because they had a working Video Indexer instance with a similar configuration, we carefully compared every detail between the functioning and non-functioning setups. Subtle differences, such as in the Managed Identity assignments or network configurations, sometimes made all the difference. In another case, simply removing and reassigning the Storage Blob Data Contributor role to the Managed Identity helped to refresh permissions.

Finally, we reviewed the Activity Logs on the Storage Account for any entries that indicated denied access attempts. This often provided insight into where the access issue originated.

In that customer’s case, following these steps helped us identify the problem and achieve a resolution. If these steps don’t resolve the issue, it may be worth considering a support ticket with Azure for additional insights into backend access details.

Thank you for answering my question.

We isolated the issue on our bicep definition (we should have mentioned that in the first message).

When creating a Video Indexer resource using the Azure Portal, with also a new Storage Account and a new User Managed Identity for it from the create wizard in East US region, videos are indexed without any issue.

Regarding firewall, private endpoints, etc. both the manually provisioned and the bicep provisioned resources have default values with no private networks or endpoints or additional configurations.

We also double checked the settings in the Portal and reviewed the exported ARM template. In the case of the manually created indexer, we found that its Storage Account has the 'allowSharedKeyAccess' property set to true, whereas the failing one doesn't have. We added it but the issue still happens.

Please find below our bicep definition:

@description('Video indexer resource name')
param fullName string

@description('Storage account resource name')
param storageAccountFullName string

@description('Location for all resources')
param location string

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
  name: fullName
  location: location
}

resource videoIndexerStorageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountFullName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
  }
}

resource videoIndexer 'Microsoft.VideoIndexer/accounts@2024-01-01' = {
  name: fullName
  location: location
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${managedIdentity.id}': {}
    }
  }
  properties: {
    storageServices: {
      resourceId: videoIndexerStorageAccount.id
      userAssignedIdentity: managedIdentity.id
    }
  }
}

// Grant Contributor role to the managed identity for the Video Indexer resource
resource videoIndexerServicesAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: videoIndexer
  name: guid(resourceGroup().name, 'Contributor', managedIdentity.id)
  properties: {
    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
    principalId: managedIdentity.properties.principalId
    principalType: 'ServicePrincipal'
  }
}

// Grant Storage Blob Data Contributor role to the managed identity for the storage account
resource videoIndexerStorageAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: videoIndexerStorageAccount
  name: guid(videoIndexerStorageAccount.id, 'Storage Blob Data Contributor', managedIdentity.id)
  properties: {
    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
    principalId: managedIdentity.properties.principalId
    principalType: 'ServicePrincipal'
  }
}

output accountId string = videoIndexer.properties.accountId

@Mauricio Rojas Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

.

Suggestions:

Please open the failing storage account from Azure portal and compare the below settings with the working storage account. Ensure that it is same as working storage account:

• Configuration
• Networking
• Bicep to include: Use the allowSharedKeyAccess in your bicep.
• Configuration
• Networking
• Bicep to include: Use the allowSharedKeyAccess in your bicep.
• Properties

Action Plan:

If none of the above suggestions help, Please share the storage account name and the time of the issue in UTC over private message. I will look at the backend logs.

.

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Hi @navba-MSFT , thank you for your answer.

I followed all the suggestions without success. How can I send you a private message with the information?

Comment was not appearing until I sent it again.