Migrating databases to Azure SQL Managed Instance or Azure SQL Virtual Machine is a critical step in modernizing enterprise infrastructure. With security and compliance top of mind, Azure Database Migration Service (DMS) has introduced key changes to its Azure portal experience—especially around permission for blob container access.
Why the Change?
Previously, in case of Azure Portal, DMS relied on account key-based access to Azure Blob Storage for listing and accessing backup files on the migration configuration page. While functional, this approach is not best in terms of security, especially for industries which prohibit the use of shared keys.
Now, DMS's Azure portal uses security context of the current signed in user on the Azure portal to list and access backup files in the blob container, making it better security approach.
Impact of the Change
When migrating to Azure SQL Managed Instance or Azure SQL Virtual Machine via Azure portal make sure the current signed in user has Storage Blob Data Reader role on the Blob container that contains the backup files. This permission is needed to list folders and files in the blob container during migration setup via Azure portal only.
If the current signed in user lacks the Storage Blob Data Reader role on the Blob container, users will encounter the following error:
Error:
"Blob container selection error: Error listing the contents of the container: This request is not authorized to perform this operation using this permission."
Solution: Make sure the current signed in user has "Storage Blob Data Reader" role on the Blob container that contains the backup files.
For more information, refer :
Microsoft