I get this error when i try to create either a source or sink dataset in Blob

Daniel Sansie 0 Reputation points
2026-08-06T15:07:08.4833333+00:00

User's image

Failed to load

Blob operation failed for: Blob Storage on container '' and path '/' get failed with 'The remote server returned an error: (403) Forbidden.'. Possible root causes: (1). Grant service principal or managed identity appropriate permissions to do copy. For source, at least the “Storage Blob Data Reader” role. For sink, at least the “Storage Blob Data Contributor” role. For more information, see https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-blob-storage?tabs=data-factory#service-principal-authentication. (2). It is possible that some IP address ranges of Azure Data Factory are not allowed by your Azure Storage firewall settings. For Azure Data Factory IP ranges please refer to https://docs.microsoft.com/en-us/azure/data-factory/azure-integration-runtime-ip-addresses. If you allow trusted Microsoft services to access this storage account option in firewall, you must use https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-blob-storage?tabs=data-factory#managed-identity. For more information on Azure Storage firewalls settings, see https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal.. The remote server returned an error: (403) Forbidden.StorageExtendedMessage=Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:c9901b97-c01e-0043-5bb4-25f729000000 Time:2026-08-06T15:01:03.1784179Z, The remote server returned an error: (403) Forbidden. Activity ID: f7016078-4eff-45bb-ad7c-5639c314f525

Azure Storage
Azure Storage

Globally unique resources that provide access to data management services and serve as the parent namespace for the services.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-06T15:07:35.9233333+00:00

    A 403 while browsing Blob from Azure Data Factory usually means one of these is blocking access:

    1. RBAC permissions are missing
      • If the linked service uses a managed identity or service principal, assign the correct Azure RBAC role on the storage account, container, or higher scope.
      • For read/browse operations, use at least Storage Blob Data Reader.
      • For sink/write operations, use at least Storage Blob Data Contributor.
    2. Storage firewall or network rules are blocking the request
      • In the storage account, check Firewalls and virtual networks.
      • If access is limited to selected networks, make sure the runtime that ADF uses can reach the storage account.
      • If other Azure services need backend access to the storage account, confirm the service is allowed as a resource instance or configure the trusted Azure services exception.
    3. Managed virtual network / endpoint mismatch
      • If using Managed virtual network IR, Blob and ADLS Gen2 access through the public endpoint is not supported reliably. Use private endpoints on both source and sink, or switch to public IR only.
    4. Managed identity with Blob network restrictions
      • If Blob storage is configured with an Azure Virtual Network endpoint and Azure Synapse/ADF uses managed identity, turn on Allow trusted Microsoft services to access this storage account under Firewalls and virtual networks.
    5. Authentication/signature problems
      • The message Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature can also indicate an authentication issue.
      • For Blob 403 troubleshooting, check whether the failure is caused by RBAC, SAS/shared key configuration, firewall rules, private endpoints, or public endpoint restrictions.

    A practical order to troubleshoot:

    1. In ADF, identify the linked service authentication type: managed identity, service principal, account key, or SAS.
    2. If using managed identity/service principal, assign:
      • Storage Blob Data Reader for source browsing
      • Storage Blob Data Contributor for sink/write
    3. In the storage account, open Networking / Firewalls and virtual networks and verify:
      • public access settings
      • allowed IPs/subnets
      • trusted Microsoft services setting if applicable
    4. If using Managed virtual network IR, use private endpoints for storage, or move both source and sink to public IR only.
    5. If using SAS or account key, review token/key validity, permissions, expiry, and whether Shared Key authorization is allowed.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.