Unable to create flow: Please grant workspace/registry read access to the source storage account.

@Allen Nugent Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

.

To resolve the "Unable to create flow" error, you'll need to grant the necessary read access to your Azure storage account.

Plan 1:

Steps to Grant Access RBAC permissions:

Navigate to Azure Portal:

• Go to the Azure Portal.

Select Your Storage Account:

  - In the left-hand menu, select **Storage accounts**.
  
     - Click on the storage account that you are using for your prompt flow.
     
     **Access Control (IAM)**:
     
        - In the storage account menu, find and click on **Access Control (IAM)**.
        

1. Add Role Assignment:

• Click on Add role assignment.
  • In the Role dropdown, select Reader and Storage Blob Data Contributor, depending on the level of access you need.
  • In the Assign access to dropdown, choose User, group, or service principal.
  Select the User or Service Principal:

  - Search for the user or service principal that needs access (this could be the identity used by your workspace).
  
     - Select it and click **Save**.
  
     **Verify Permissions**:
  
        - Ensure that the role assignment appears in the list and that the permissions are correctly set.
  

.

.

Plan 2:

• Check Networking Settings: If your storage account has networking restrictions, ensure that the necessary IP addresses or virtual networks are allowed.
  • Use Managed Identity: If your application uses a managed identity, ensure that it has the appropriate permissions assigned.

After following these steps, try deploying your prompt flow again. If you have any follow-up questions, please let me know. I would be happy to help.

Thanks , but I can't see how to make this work.

First, there is no "Role" dropdown: I'm on an "Add role assignment" page containing a big table with headings "Name", "Description", "Type", "Category", "Details" and I don't know how to use it.

Second, in the tutorial, the dependencies (incl. storage) get created automatically when the project is created in AI Studio: I think there is an opportunity to change the IAM settings for the storage account.

I think they have broken the process that the tutorial expects and not updated the doco. Maybe I should just abandon the tutorial and hope I can learn something, anyway.

Networking settings are okay.

I got to the page you were talking about. The required roles are there.

@Allen Nugent Thanks for getting back. I am sharing a few more plan:

1. If you are using Promptflow with Azure Storage (including Azure Data Lake Storage Gen 2), you must also assign the Storage File Data Privileged Contributor RBAC role permissions. More info here.**
2. Also the error you are encountering is clearly an issue with the RBAC permissions. So please provide the screenshot of the Access Control IAM (of Azure Storage account level) --> RBAC roles, so that I can validate and check if things are in place. (Send this over private message).
3. Ensure that there are no Deny assignments within the Storage Account level.

Awaiting your reply.