AuthorizationResourceTypeMismatch

Question

AuthorizationResourceTypeMismatch

John Fabiani 25

How do I deal with this error? I am able to login using azcopy but when I attempt copy data I get this error "AuthorizationResourceTypeMismatch"

I am a newbie and I do not see where to set permissions and what permissions are missing.

Johnf

kagiyama yutaka 5,410 Reputation points

2026-07-30T23:48:43.4666667+00:00

Could you add a bit more detail about your AzCopy setup? For example, the exact command you ran, the type of URL you are copying to, and how you are authenticating. This will help identify why AuthorizationResourceTypeMismatch is happening.
Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2026-08-07T08:04:08.5966667+00:00
Hello John Fabiani

**
**I understand that you are getting the "AuthorizationResourceTypeMismatch" error in AzCopy.

From the details shared, this usually means the authenticated identity or authorization method does not have the right permissions for the target storage resource. Please note that azcopy login only signs in the user and does not automatically grant data access permissions.

To troubleshoot, please review the following:

Check that the user, service principal, or managed identity used with AzCopy has the appropriate Azure Storage data access role assigned. Depending on the operation, roles such as Storage Blob Data Reader, Storage Blob Data Contributor, or Storage Blob Data Owner may be required. These roles can be assigned from Storage Account → Access Control (IAM) → Add Role Assignment.

If a SAS token is being used, make sure it was generated for the correct storage resource type and includes the permissions needed for the intended operation. A SAS token scoped incorrectly can cause this error.

Confirm that the AzCopy command is pointing to the correct storage endpoint (for example, Blob Storage versus Azure Files) and that the authentication method being used is supported for that resource type.

If data is being copied between two storage accounts using Microsoft Entra ID authentication, ensure that the identity has the appropriate permissions on both the source and destination storage accounts.

Could you share the following details for further investigation:

The exact AzCopy command being used.

Which authentication method being used (Microsoft Entra ID login, SAS token, service principal, etc.)?

Share the source and destination storage types (Blob Storage, ADLS Gen2, Azure Files, etc.).

Once we have this information, we will be happy to provide more targeted guidance.
Harshavardhan Sriramula 0 Reputation points Microsoft External Staff Moderator

2026-08-10T20:22:58.47+00:00

Hello @John Fabiani ,

Following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Harshavardhan Sriramula 0 Reputation points Microsoft External Staff Moderator

2026-08-11T22:05:19.42+00:00

Hello @John Fabiani ,

Following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.

2 answers

Your answer

kagiyama yutaka 5,410 Reputation points

2026-07-30T23:48:43.4666667+00:00

Could you add a bit more detail about your AzCopy setup? For example, the exact command you ran, the type of URL you are copying to, and how you are authenticating. This will help identify why AuthorizationResourceTypeMismatch is happening.
Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2026-08-07T08:04:08.5966667+00:00

Hello John Fabiani

**
**I understand that you are getting the "AuthorizationResourceTypeMismatch" error in AzCopy.

From the details shared, this usually means the authenticated identity or authorization method does not have the right permissions for the target storage resource. Please note that azcopy login only signs in the user and does not automatically grant data access permissions.

To troubleshoot, please review the following:

Check that the user, service principal, or managed identity used with AzCopy has the appropriate Azure Storage data access role assigned. Depending on the operation, roles such as Storage Blob Data Reader, Storage Blob Data Contributor, or Storage Blob Data Owner may be required. These roles can be assigned from Storage Account → Access Control (IAM) → Add Role Assignment.

If a SAS token is being used, make sure it was generated for the correct storage resource type and includes the permissions needed for the intended operation. A SAS token scoped incorrectly can cause this error.

Confirm that the AzCopy command is pointing to the correct storage endpoint (for example, Blob Storage versus Azure Files) and that the authentication method being used is supported for that resource type.

If data is being copied between two storage accounts using Microsoft Entra ID authentication, ensure that the identity has the appropriate permissions on both the source and destination storage accounts.

Could you share the following details for further investigation:

The exact AzCopy command being used.

Which authentication method being used (Microsoft Entra ID login, SAS token, service principal, etc.)?

Share the source and destination storage types (Blob Storage, ADLS Gen2, Azure Files, etc.).

Once we have this information, we will be happy to provide more targeted guidance.
Harshavardhan Sriramula 0 Reputation points Microsoft External Staff Moderator

2026-08-10T20:22:58.47+00:00

Hello @John Fabiani ,

Following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Harshavardhan Sriramula 0 Reputation points Microsoft External Staff Moderator

2026-08-11T22:05:19.42+00:00

Hello @John Fabiani ,

Following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.

Answer 1

kagiyama yutaka 5,410

I think this error happens when the auth you’re using (SAS or AAD) was created for a different resource type. AzCopy only works when the SAS is blob‑scoped, or when you’re using AAD with the blob endpoint and ur identity has the Storage Blob Data Contributor role on the storage account.

Harshavardhan Sriramula 0 Reputation points Microsoft External Staff Moderator

2026-08-02T20:10:58.4133333+00:00

Hello @John Fabiani ,

Following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Harshavardhan Sriramula 0 Reputation points Microsoft External Staff Moderator

2026-08-03T22:06:32.07+00:00

Hello @John Fabiani ,

Following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.

Answer 2

AuthorizationResourceTypeMismatch is typically an authorization problem. With AzCopy, the most common causes are:

The signed-in identity does not have the correct data access role azcopy login only signs in. It does not grant blob data permissions. For blob upload or download, assign one of these roles to the user, service principal, or managed identity used by AzCopy:
- Storage Blob Data Reader for read operations
- Storage Blob Data Contributor for write operations
- Storage Blob Data Owner for management operations
In Azure portal:
1. Open Storage accounts.
2. Select the target storage account.
3. Open Access control (IAM).
4. Select Add > Add role assignment.
5. Assign Storage Blob Data Contributor if the goal is to copy files into blob storage.
6. Wait a few minutes for role assignment to propagate, then try AzCopy again.
If using a SAS token, the SAS does not include the right permissions Verify:
- the SAS start and expiry times are valid
- all required permissions were selected
- the SAS was generated by an official SDK or tool
Some operations need multiple permissions.
Storage firewall or network rules are blocking the request A 403 authorization-style failure can also happen when the storage account firewall blocks access. Check the storage account networking settings and confirm that the machine, VM, or container running AzCopy can reach the storage account. If copying from an on-premises machine, the public IP of that machine might need to be allowed in the storage account firewall.
ACLs can also block access for Data Lake Storage Gen2 scenarios If the account uses ACLs, the identity must appear in ACL entries for each file or directory being accessed, with the required permission level.
If azcopy login works but interactive sign-in is restricted by Conditional Access If sign-in issues appear later or on some devices, AzCopy device code flow can be affected by Conditional Access. In that case, alternatives include:
- using Storage Explorer
- using a managed identity
- using a service principal

A practical first path for a new user is:

Confirm the command is targeting Blob storage.
In Storage account > Access control (IAM), assign Storage Blob Data Contributor to the identity used by azcopy login.
Wait a few minutes.
Retry the copy.
If it still fails, check whether a SAS token is being used instead of Entra ID.
Then check Networking on the storage account for firewall restrictions.

References: