Azure DevOps AzCopy Authentication failed, it is either not correct, or expired, or does not have the correct permission

Question

I am using the task Azure file copy to upload the build artefacts to the blob container. But I am always getting an error as preceding.

0.0 %, 0 Done, 0 Failed, 1 Pending, 0 Skipped, 1 Total, 
INFO: Authentication failed, it is either not correct, or expired, or does not have the correct permission -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, /home/vsts/go/pkg/mod/github.com/!azure/[email protected]/azblob/zc_storage_error.go:42
===== RESPONSE ERROR (ServiceCode=AuthorizationPermissionMismatch) =====
Description=This request is not authorized to perform this operation using this permission.
RequestId:ae545517-501e-00ce-0798-ea489e000000
Time:2021-12-06T11:54:25.0571292Z, Details: 
   Code: AuthorizationPermissionMismatch
   PUT mybloburl?blockid=YjA4YjIzN2UtODJhMC1mMjQzLTUwOGYtNmYxNDcwOGJjZmY0&comp=block&timeout=901
   Authorization: REDACTED
   Content-Length: [8388608]
   User-Agent: [TFS_useragent AzCopy/10.8.0 Azure-Storage/0.10 (go1.13; Windows_NT)]
   X-Ms-Client-Request-Id: [65465-83ea-4410-450e-dd5b722b6cb3]
   X-Ms-Version: [2019-12-12]
   --------------------------------------------------------------------------------
   RESPONSE Status: 403 This request is not authorized to perform this operation using this permission.

Below is my YAML file content for this task.

steps:
- task: AzureFileCopy@4
  displayName: 'AzureBlob File Copy'
  inputs:
    SourcePath: '$(Build.ArtifactStagingDirectory)/myfile.zip'
    azureSubscription: 'my-azure-connection'
    Destination: AzureBlob
    storage: mystorage
    ContainerName: mycontainer

Answer 1

After looking at this issue, I figured out what could be the reason. As you might have already known that a new service principal will be created whenever you create a service connection in the Azure DevOps, I have explained this in detail here. To make the AzureFileCopy@4 task work, we will have to add a role assignment under the Role Assignment in the resource group. You can see this when you click on the Access control (IAM). You can also click on the Manage service connection roles in the service connection you had created for this purpose, which will redirect you to the IAM screen.

1. Click on the +Add and select Add role assignment
2. Select the role as either Storage Blob Data Contributor or Storage Blob Data Owner
3. Click Next; on the next screen add the service principal as a member by searching for the name of the service principal. (You can get the name of the service principal from Azure DevOps, on the page for the Service Connection, by clicking on the Manage Service Principal link. My service principal looked like "AzureDevOps.userna.[guid]".)

4. Click on Review + assign once everything is configured.
5. Wait for a few minutes and run your pipeline again. Your pipeline should run successfully now.

You can follow the same fix when you get the error "Upload to container: '' in storage account: '' with blob prefix: ''"