Azure VM unable to connect to azure blob storage account with error 403

AzCopy 403 errors from an Azure VM usually come from either authentication/authorization problems (SAS, RBAC, ACLs) or from network restrictions (firewall, private endpoints, copy-scope limits). Use the following checks end to end.

1. Verify AzCopy authentication method

A. If using SAS token

• Ensure the SAS token:
  • Has a valid start (st) and expiry (se) time for the current clock.
  • Includes all required permissions in sp (for example, r for read, w for write, c for create, d for delete, l for list).
  • Was generated by an official SDK or tool such as Storage Explorer.
• If any of these are wrong, AzCopy operations can fail with 403.

B. If using azcopy login (Azure AD / RBAC)

• Confirm the identity used by AzCopy has a suitable data role on the storage account/container, such as Storage Blob Data Contributor for write operations.
• If using ACLs (ADLS Gen2), ensure the identity appears in the ACL for the target path and has the required permissions.

For a checklist of SAS, RBAC, and ACL issues that cause 403, see the SAS, Azure RBAC, and ACL sections in the AzCopy troubleshooting guidance.

2. Check storage account firewall and network access

From the VM’s perspective, the storage account must allow its traffic.

• If accessing over the public endpoint:
  • In the storage account firewall settings, ensure the VM’s public IP (or the outbound IP of its hosting component) is allowed.
  • If the account is restricted to specific virtual networks/subnets, verify the VM’s subnet is included.
  • Confirm there is no network security perimeter rule that overrides the firewall and blocks access.
• If using a private endpoint:
  • Ensure DNS for the storage account name resolves to the private endpoint IP from the VM.
  • Confirm the VM’s subnet has network connectivity to the private endpoint subnet.
  • If using both Blob and Data Lake endpoints, ensure private endpoints exist for each required resource.

If the storage firewall doesn’t allow access from the VM (hosting component), AzCopy returns 403.

3. Validate copy scope and source/destination access (if copying between accounts)

If AzCopy is copying between two storage accounts:

• The VM must have network access to both source and destination accounts (firewall rules, vNet rules, private endpoints).
• Check the destination account’s AllowedCopyScope (Permitted scope for copy operations):
  • If set to Microsoft Entra ID, only source accounts in the same tenant are allowed.
  • If set to PrivateLink, only source accounts with private links to the same virtual network are allowed.
  • If misconfigured, AzCopy copy operations can fail with 403.

4. Use the 403 diagnostics checklist for Blob Storage

If the error persists, apply the general 403 checklist:

• Ensure secure transfer (HTTPS) is used if required.
• Confirm the correct Azure RBAC role is assigned at the right scope (subscription, resource group, storage account, or container).
• Re-check SAS token validity, permissions, and generation method.
• If using ACLs (ADLS Gen2), verify entries and permissions for the identity.
• Confirm Shared Key authorization is allowed if using account keys.
• Verify public endpoint, private endpoint, and network security perimeter settings.
• Ensure the storage account and subscription are not disabled.

5. Practical sequence to troubleshoot on the VM
6. Run a simple AzCopy list to the container using the same auth method:
   • If this fails with 403, focus on SAS/RBAC/ACL and firewall.
7. From the VM, test basic connectivity (e.g., nslookup and ping to the storage account FQDN; HTTP/HTTPS reachability via tools that respect firewall rules).
8. Temporarily relax storage firewall (e.g., allow all networks) to see if 403 changes to another error:
   • If it works when open but fails when restricted, the issue is firewall/IP/network rules.
9. If copying between accounts, test upload/download from the VM to a single account first, then reintroduce cross-account copy.

Following these steps isolates whether the 403 is caused by AzCopy authentication/authorization (SAS, RBAC, ACLs) or by network/firewall/private endpoint configuration from the VM to the storage account.

References:

• Troubleshoot 403 errors in Azure Blob Storage
• Troubleshoot issues in AzCopy v10
• Error codes: AzCopy V10