Azure Storage topics

Azure Files Manage Access is missing

Andreas-WPH — Tue, 10 Mar 2026 10:29:27 GMT

Good day,

We have fully and correctly configured an Azure File Share and the associated permissions. All required Azure RBAC roles as well as the necessary data plane permissions are assigned.

However, we are observing inconsistent behavior in the Azure Portal regarding the “Manage access” buttons:

At times, the “Manage access” buttons are visible:

- In the top menu bar of the file share

- In the context menu (three‑dot menu) of individual directories

At other times, these buttons are not displayed at all, even though:

- The same user with the same permissions is used

- The same storage account and the same file share are accessed

The behavior is sporadic and not reproducible in a controlled manner.

Already verified:

Required Azure RBAC roles are assigned
Required permissions for Azure Files are correctly configured
Permissions are effective and functional
No error messages are shown in the Azure Portal when the buttons are missing

A screenshot showing the state when the functionality was working is here.

We would appreciate your support in investigating this issue.

Backing up Azure Files - High cost Read operations

TechGeek1 — Fri, 27 Feb 2026 18:11:17 GMT

I have found that Azure Files is unusable for large deployments due to the high cost of backups, especially for deployments with lots of small files. Most backup solutions have a changed block tracking mechanism and filter driver that can quickly determine what has changed between the prior backup. If nothing has changed since the last backup, the job quickly makes this determination and the backup job can take seconds to complete. But with Azure Backup backing up Azure Files, it appears to me that each backup has to enumerate every file and blob before making this determination. I first noticed this when I created a 1TB file share and nothing changed with the files from the prior backup and the job took 12 hours to complete. I then looked at my bill and it was $12 in read operations just for that backup where no files have changed. Azure Files is an awesome product, but securing your backups in a vault using Azure Backup just isn't doable from a price perspective. Does anyone know if there are changes on the horizon to Azure Backup in terms of a more robust change block tracking system?

Manage/restore metadata when blob is updated

kathyhurchla — Tue, 18 Nov 2025 16:16:08 GMT

I'm using an Azure Storage container of block blobs as a data source for an Azure AI Search Index, and I'm using Blob metadata key value pairs for some custom data.

But metadata gets wiped when a blob is updated. How are folks managing that?

For reference, I've got a CosmosDB set up also for now with a cross-reference I can restore from, but it's manual. I considered using Cosmos as my data source instead, but I also need a place to store/serve media files from related to these records.

Azure SQL Access is Denied reading Azure Storage file

JohnTM — Mon, 03 Nov 2025 10:36:58 GMT

undefined

Differences between PowerShell and Browser when upload file

Petri-X — Tue, 30 Sep 2025 08:04:55 GMT

Hi All,

Anybody have noticed similar behavior? When uploading the file into the storage account that is working find. But if on the same workstation you try to do this using the PowerShell command: Set-AzStorageBlobContent the if fails to: ErrorCode: AuthorizationPermissionMismatch

Here is also the longer trace:

$sa = get-azstorageAccount -ResourceGroupName RG01 -Name storage01
$strCTX = New-AzStorageContext -StorageAccountName $sa.StorageAccountName
$strCTX | Set-AzStorageBlobContent -File C:\temp\test.txt -Container delate -Blob test.txt -Verbose

VERBOSE: Performing the operation "Set" on target "test.txt".
Set-AzStorageBlobContent: This request is not authorized to perform this operation using this permission. HTTP Status Code: 403 - HTTP Error Message: This request is not authorized to perform this operation using this permission.
ErrorCode: AuthorizationPermissionMismatch
ErrorMessage: This request is not authorized to perform this operation using this permission.
RequestId: 3150eeb6-761e-0096-2edd-56e8bc000000
Time: Tue, 30 Sep 2025 10:25:51 GMT
VERBOSE: Transfer Summary
--------------------------------
Total:  1.
Successful: 0.
Failed: 1.

Some thing which makes this a bit more odd, is, when I'm looking for the roles and their data accesses, they both looks like following:

So I'm not even sure how I do have access to that SA.

Sentinel to Detect Storage Account Created

cybersal82 — Wed, 13 Aug 2025 18:22:59 GMT

Hi Everyone,

When trying to generate query to show storage account when they are created, I'm having bad luck of not been able to see it in Sentinel. The KQL query I have is:

AzureActivity
| where ResourceProviderValue == "MICROSOFT.STORAGE"
| where OperationNameValue == "Microsoft.Storage/storageAccounts/write"

When the query is running, it generate no output. Even if take away "| where OperationNameValue == "Microsoft.Storage/storageAccounts/write"", I can see the storage account but not specifically when I spun up a test storage account to detect it.

I'll appericate if anyone can help me get this query to work.

Side note: I have Azure Monitor Alert enable and I get email but I want those alerts to be shown in Sentinel as an incident.

How to archive diagnostic logs sent to storage account

reavop — Thu, 10 Jul 2025 05:08:48 GMT

I need help understanding storage append blobs created by diagnostic settings. When a diagnostic setting is configured to log to a storage account, the logs are created as append blobs. I have compliance requirements that mean I need to retain these blobs in immutable storage for 6 years, however, it seems I cannot use the blob lifecycle management feature to change the access tier of the append blobs to "archive tier". It is only supported for block blobs.

This page states "Setting the access tier is only allowed on Block Blobs. They are not supported for Append and Page Blobs."
https://learn.microsoft.com/en-au/azure/storage/blobs/access-tiers-overview

I feel like the lifecycle management feature is often touted as the answer to how to change the access tier for long-term storage scenarios, but it seems that it does not even work with diagnostic logs, which is pretty baffling.

How does Microsoft recommend changing diagnostic logs in a storage account to archive tier storage? The only answer I can see would be to implement some an azure function or logic app to read each blob as it's written and write it back to another storage account as a block blob. But the, how do you when the new file has finished being written to. Nevermind the fact that this violates my immutability requirement.

How do I unlock my account from a company oit of business?

jrsitman — Thu, 03 Apr 2025 22:43:19 GMT

I signed up with IFI Technical to manage Azure backup and they are out of business. How do I unlock my account from them and change my billing?

Thanks,

J.R.

Unable to upload .exe files to Azure blob container in Azure Storage Account

Lancelotbaghel30 — Mon, 03 Mar 2025 11:37:36 GMT

I am trying to upload an exe file to my Azure Blob container but I am getting below ( forbidden ) error.

Also when I tried with .txt, .ppt .ps1 extensions I am able to upload those. Is there any restriction MS has for (.exe files). I am having storage
I am having owner permission for the Storage Account resource.

Kindly Help

Thanks and Regards,

Hirdesh

Enable ADDS authetication fails

KartikDogra — Wed, 26 Feb 2025 07:38:15 GMT

I am trying to execute the Enable ADDS authentication using Azhybridfiles module.

when I try to execute the command
Join-AzStorageAccount ` -ResourceGroupName $ResourceGroupName ` -StorageAccountName $StorageAccountName ` -SamAccountName $SamAccountName ` -DomainAccountType $DomainAccountType ` -OrganizationalUnitDistinguishedName $OuDistinguishedName

it keeps on progressing with below warning but the progress stuck without completing or any error message.

Azure Table Storage not accessable

lboe — Fri, 07 Feb 2025 12:59:48 GMT

Since yesterday, 6th February 2025, access from Excel to Azure Tables with Entra User is no longer possible.

The Storage Account Logs shows AuthenticationErrors.

In Excel, access to the Storage Account is done via: https://saname.table.core.windows.net

Access to the SA is done with Entra User. The users have the permission as Storage Table Data Reader.

We tested various storage accounts and locations but encountered the same issue.

Access via Azure Explorer, is still possible without any issues.

Azure file Share Performance issue

pk_Tech — Fri, 31 Jan 2025 19:59:42 GMT

Hi Team,

I have recently migrate on-premise file server to Azure file share and setup AD authentication. It's public endpoint but we i am copied like 6 GB data then it was taken more then 2 hours even my internet bandwidth very good.

I have setup hot tier but still performance is remain the same. support team is also not able to provide proper resolution.

how can we give access to specific folder only within blob in azure storage account container

Zer0cool114 — Thu, 16 Jan 2025 15:07:56 GMT

I am trying to grant access to specific folder and its contents within a blob in a container. I have tried using ACL and SAS URLs but it gives access to whole container.

Azure NetApp Files | Azure cli command to suspend/resume backup at volume level

DurgalakshmiSivadas — Mon, 04 Nov 2024 12:45:49 GMT

I'm looking for the corresponding azure cli for the following action
suspend a backup policy for a specific volume

I do see a cli (at policy level)
az netappfiles account backup-policy update, which has got the following parameter

[--enabled {0, 1, f, false, n, no, t, true, y, yes}]

The property to decide policy is enabled or not. Accepted values: 0, 1, f, false, n, no, t, true, y, yes

But this is at the netapp account > policy level

I'm unable to find the azure cli to do this at specific volume level.

Is there a cli for this action at Volume level in the Configure Backups dialog box > Policy State { Suspend/Resume}, how shall we achieve this if we have programmatically do this step.

Advise on upload processing

andreas1415 — Sun, 03 Nov 2024 09:07:01 GMT

Hello, I am here to seek some advise regarding the architecture of an application. It is written in .net. The application has a part where tenants can upload fotos into their account (blob storage). They can do that either via Web UI or by connecting an uploader application (like Azure Storage Explorer). Each tenant basically has some kind of image-inbox. Those uploaded images need to be processed afterwards. It is worth to mention that we use Aspire and Azurite when developing.

My issue starts with the processing of those images. First I was using azure functions to process those images and they have been triggered by storage blob events. This worked but was kind of slow. When we installed Aspire it was even not possible to use Azure Functions anymore.

This was the time when we removed Azure Functions and created our own "Worker" application. This application polled the Azure Blob Storage and if there were images started a sub-worker per tenant to process those files. This was already much faster and more reliable. But after deploying to production we quickly found out, that the cost sky-rocketed due to the polling.

I then looked into then new GetChangeFeedClient approach which seems to be a less expensive version to get informed about new data in the blob storage. I developed that just to find out, that it is not supported in Azurite, thus we can not even run in locally. At this point I do not even understand why Azurite does not support all of the Azure features. How can anyone develop something without a simulator? Anyway this seems to be a dead end.

I also thought about Azure Event Grid but that is also not supported on Azurite.

At this point I am not sure what to do. Should I wait for .net 9 and go back to Azure Functions because they will be supported and will I live with the slow processing and overhead? Or should I ditch Azure Blob Storage and find another storage solution?

Any advise is appreciated...

disk size on azure wrong size in ubuntu

wpyung — Wed, 23 Oct 2024 14:06:10 GMT

I create an Azure VM running Ubuntu.

I added permanent storage of 64GB:

Size 64 GiB

Storage type Premium SSD LRS

IOPS 240

Throughput (MBps) 50

Disk tier P6

However from within Linux it shows as 8GB

df -h /dev/sdb1
Filesystem Size Used Avail Use% Mounted on
/dev/sdb1 7.8G 28K 7.4G 1% /mnt

any ideas what is wrong ?

Thanks

Peter

Azure File Share : Unable to mount Azure file share when executing docker-compose

jamesterzzzzzz — Sun, 13 Oct 2024 00:59:21 GMT

I am trying to set up a container service locally that mounts an Azure file share as its extended storage. However, I am encountering an error despite verifying the keys and storage name. Here is the error message I am receiving.

[error]

Error response from daemon: failed to populate volume: error while mounting volume '/mnt/cloudstor/ipfs-docker_ipfs-azure': VolumeDriver.Mount: mount failed: exit status 32

output="mount error(13): Permission denied\nRefer to the mount.cifs(8) manual page (e.g. man mount.cifs)\nmount error(13): Permission denied\nRefer to the mount.cifs(8) manual page (e.g. man mount.cifs)\nmount: mounting //fileshare.file.core.windows.net/ipfs-share on /mnt/cloudstor/ipfs-docker_ipfs-azure failed: Permission denied\n

Azure NetApp Files - Error creating the volume

mauricio1480 — Fri, 11 Oct 2024 16:32:02 GMT

I'm encountering an issue while trying to create a new volume on my NetApp system, which is integrated with Azure AD (Entra ID). I don't have a traditional on-premises Active Directory or Domain Controller and am relying entirely on Azure AD.

When I attempt to create the volume, I receive the following error:

Error when creating - Failed to create the Active Directory machine account "NETAPP-B213". Reason: LDAP Error: Local error occurred Details: Error: Machine account creation procedure failed
[ 76] Loaded the preliminary configuration.
[ 79] Successfully connected to ip 10.0.8.4, port 88 using TCP
[ 111] Successfully connected to ip 10.0.8.4, port 389 using TCP
[ 111] Entry for host-address: 10.0.8.4 not found in the current source: FILES. Ignoring and trying next available source
[ 122] Successfully connected to ip 10.0.8.4, port 88 using TCP
[ 129] FAILURE: Unable to SASL bind to LDAP server using GSSAPI: Local error
[ 132] Unable to connect to LDAP (Active Directory) service on evri3ba830eo2hg.migramer.com (Error: Local error)
[ 132] Unable to make a connection (LDAP (Active Directory):MIGRAMER.COM), Result: RESULT_ERROR_LDAPSERVER_LOCAL_ERROR.
(Code: ErrorFromNFSaaSErrorState)

Has anyone encountered this issue or have any insights on resolving this LDAP error with Azure AD and NetApp? Any assistance would be greatly appreciated!

Thanks, Mauricio

Generating a SAS Token for Azure Blob Storage in C# using APIs

mohammedbaba — Tue, 10 Sep 2024 14:11:09 GMT

Hello Community,

I am trying to generate a SAS token for a Blob Storage account using C#. However, I'm encountering an error when trying to authenticate the request:

<Error> <Code>AuthenticationFailed</Code> <Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:0ead0723-901e-002c-7b88-037068000000 Time:2024-09-10T13:52:02.2658050Z</Message> <AuthenticationErrorDetail>Signature fields not well formed.</AuthenticationErrorDetail> </Error>

To clarify, I am trying to generate the SAS token without using the NuGet package "Azure.Storage.Blobs". I managed to generate the SAS token successfully using the library, but now I want to achieve the same result purely with APIs. Below is the code I’m using to generate the SAS token:

private string GenerateSasToken(string accountName, string accountKey, string containerName, string blobName) { // Define SAS parameters string signedPermissions = "r"; // Read permissions string signedStart = DateTime.UtcNow.AddMinutes(-5).ToString("yyyy-MM-ddTHH:mm:ssZ"); // Start time is 5 minutes ago to account for clock skew string signedExpiry = DateTime.UtcNow.AddHours(8).ToString("yyyy-MM-ddTHH:mm:ssZ"); // Expiry time 8 hours from now string signedResource = "b"; // Blob resource type string signedVersion = "2022-11-02"; // Storage service version string signedProtocol = "https"; // HTTPS only string signedIp = ""; // No IP restriction // Canonicalized resource: "/blob/account/container/blob" string canonicalizedResource = $"/blob/{accountName}/{containerName}/{blobName}"; // Construct the string-to-sign string stringToSign = $"{signedPermissions}\n" + $"{signedStart}\n" + $"{signedExpiry}\n" + $"{canonicalizedResource}\n" + $"\n" + // signedIdentifier (optional, left empty) $"{signedIp}\n" + $"{signedProtocol}\n" + $"{signedVersion}\n"; // Decode the account key from Base64 byte[] keyBytes = Convert.FromBase64String(accountKey); // Create HMAC-SHA256 hash using (HMACSHA256 hmac = new HMACSHA256(keyBytes)) { byte[] signatureBytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(stringToSign)); string signature = Convert.ToBase64String(signatureBytes); // Construct the SAS token var sasToken = HttpUtility.ParseQueryString(string.Empty); sasToken["sp"] = signedPermissions; sasToken["st"] = signedStart; sasToken["se"] = signedExpiry; sasToken["spr"] = signedProtocol; sasToken["sv"] = signedVersion; sasToken["sr"] = signedResource; sasToken["sig"] = HttpUtility.UrlEncode(signature); // URL-encoded signature // Return the full blob URL with the SAS token return $"https://{accountName}.blob.core.windows.net/{containerName}/{blobName}?{sasToken}"; } }

Problem:

I am getting the error that the signature fields are not well-formed. This seems to indicate that there is an issue with how the string-to-sign or the signature itself is being constructed. Does anyone have experience with this error, or can you spot anything wrong with my code?

Any help or advice would be greatly appreciated!

I really appreciate any help you can provide.

Azure Premium disk host caching

emiljj — Tue, 10 Sep 2024 10:51:49 GMT

I have a Zabbix application which is writing and reading from PostgreSQL DB. The PostgreSQL DB is installed in a azure VM with premium SSD data disk. Should I change the host cache on data disk to read/write, will it have any issues. Currently its in read only option