Copilot Studio agent - The connector 'Azure Blob Storage' returned an HTTP error with code 403. Inner Error: Error from token exchange: Permission denied due to missing connection ACL

The 403 with Permission denied due to missing connection ACL indicates an authorization problem on the connection used by the Azure Blob Storage connector, not a problem with the storage account itself. In other words, the Copilot Studio/Power Platform connection can no longer get a valid token or is no longer allowed to use that connection, even though the service principal and storage keys still work directly.

From the context, 403 errors of this type are typically caused by:

1. AuthorizationPermissionMismatch / insufficient permissions on the data operation.
2. Changes to SAS/shared key, RBAC, or network rules that invalidate an existing connection.
3. Policy or ACL changes on the platform side (for example, environment or connector ACLs) that block token exchange.

Given that:

• It worked earlier the same day.
• UAT still works with the same SPN pattern.
• Direct calls via Postman and Copilot Studio test succeed.
• The error mentions “missing connection ACL” during token exchange.

The most likely cause is a change in the Prod environment’s connection/connector security or ACL rather than the storage account itself.

Use this checklist to isolate and fix it:

1. Validate the storage-side authorization path
   • Confirm the identity used by the connector (service principal or key-based) still has the required permissions for the operation:
     • For write operations, ensure the identity has at least Storage Blob Data Contributor or Storage Blob Data Owner at the correct scope (storage account or container).
     • If using SAS, verify the SAS includes sp permissions for write and delete when overwriting blobs, as described under AuthorizationPermissionMismatch.
   • If using SAS or user delegation SAS, verify:
     • st/se are valid and within any delegation key window.
     • The sp field includes all required permissions.
     • The token has not expired and is not affected by clock skew.
   • If using account keys, confirm keys were not regenerated; if they were, update the connector connection.
2. Check storage network and firewall configuration
   • Verify the storage account still allows access from the network used by the Copilot Studio/Teams agent:
     • If public network access is restricted, ensure the connector’s outbound IPs or virtual network are still allowed.
     • Confirm no new firewall rules or virtual network restrictions are blocking the request.
   • If the error code on the storage side is AuthorizationFailure or a generic 403, check:
     • Public network access is not disabled.
     • IP address restrictions or virtual network rules have not changed.
3. Review SAS/connection configuration in Prod vs UAT
   • Compare the Prod connector connection configuration with UAT:
     • Authentication type (service principal vs key vs SAS).
     • Any SAS token parameters (permissions, expiry, sip IP restrictions).
   • If sip (IP restriction) is used in SAS, ensure the requests from the Copilot/Teams environment are not blocked by too narrow an IP range. Internal service calls from Azure can come from different IPs and cause 403 AuthorizationFailure when sip is set.
4. Apply the general 403 diagnostic checklist
   • Confirm:
     • Secure transfer (HTTPS) is used if required.
     • Azure RBAC roles are correctly assigned and scoped.
     • Shared key authorization is allowed if using account keys.
     • No stored access policy has been changed to revoke or narrow permissions earlier than the SAS expiry.
     • Encryption scope settings have not changed (for example, default encryption scope with override disabled, or a disabled customer-managed key causing 403s).
   • Ensure the storage account or subscription is not disabled.
5. Focus on the “missing connection ACL” aspect
   • Because the error is raised during token exchange, investigate:
     • Whether any environment-level security policies or connector ACLs were changed in the managed Prod environment (for example, DLP policies, connector usage restrictions, or who can use a given connection).
     • Whether the connection owner or the app identity lost permission to use that connection.
   • Recreate the Azure Blob Storage connection in Prod and rebind it to the tool in Copilot Studio, then test again. This often clears stale ACL or token metadata.
6. If the error persists
   • Capture the full 403 error from the storage logs (including x-ms-error-code) to see whether it is AuthorizationPermissionMismatch, AuthorizationFailure, or another specific code, and then apply the matching guidance:
     • AuthorizationPermissionMismatch: fix SAS permissions or RBAC roles.
     • AuthorizationFailure: fix network/firewall or public access settings.
   • Use Azure resource logs for the storage account to confirm which identity and authorization method are being used and why the request is denied.

In summary, the storage account itself is reachable (Postman and tests succeed), so the fix is likely in the Prod connector connection: revalidate or recreate the connection, ensure the identity used by that connection still has the correct RBAC and network access, and verify no new environment/connector ACL or DLP policy is blocking token exchange.

References:

• Troubleshoot 403 errors in Azure Blob Storage
• Troubleshoot 403 errors in Azure Blob Storage – Common errors related to authorization failures
• Troubleshoot 403 errors in Azure Blob Storage – Common errors related to authentication failures
• Troubleshoot 403 errors in Azure Blob Storage – Comprehensive diagnostic checklist