unable to connect adls gen storage from Purview

Vineet S 265 Reputation points
2024-06-11T05:06:13.7233333+00:00

unable to connect adls gen storage from Purview gettting following error

ADLS Gen2 operation failed for: Storage operation '' on container 'bloblblob' get failed with 'Operation returned an invalid status code 'Forbidden''. Possible root causes: (1). It's possible because the service principal or managed identity don't have enough permission to access the data. (2). It's possible because some IP address ranges of Purview are not allowed by your Azure Storage firewall settings. Purview IP ranges please refer https://docs.microsoft.com/en-us/azure/data-factory/azure-integration-runtime-ip-addresses. If you allow trusted Microsoft services to access this storage account option in firewall, you must use https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-blob-storage?tabs=data-factory#managed-identity. For more information on Azure Storage firewalls settings, see https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal.. Account: 'blockblobstorage25'. FileSystem: 'bloblblob'. ErrorCode: 'AuthorizationPermissionMismatch'. Message: 'This request is not authorized to perform this operation using this permission.'. RequestId: '51ea4c9c-801f-0057-74a9-b66026000000'. TimeStamp: 'Tue, 04 Jun 2024 18:02:30 GMT'..

Azure Data Lake Storage
Azure Data Lake Storage
An Azure service that provides an enterprise-wide hyper-scale repository for big data analytic workloads and is integrated with Azure Blob Storage.
1,403 questions
Azure Cloud Services
Azure Cloud Services
An Azure platform as a service offer that is used to deploy web and cloud applications.
665 questions
Azure Synapse Analytics
Azure Synapse Analytics
An Azure analytics service that brings together data integration, enterprise data warehousing, and big data analytics. Previously known as Azure SQL Data Warehouse.
4,599 questions
Azure Data Factory
Azure Data Factory
An Azure service for ingesting, preparing, and transforming data at scale.
9,976 questions
Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
1,018 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nehruji R 3,971 Reputation points Microsoft Vendor
    2024-06-11T08:00:32.6233333+00:00

    Hello Vineet S,

    Greetings! Welcome to Microsoft Q&A Platform.

    The error message you’re encountering, ‘AuthorizationPermissionMismatch’, indicates that there’s an issue with permissions when connecting to Azure Data Lake Storage Gen2 (ADLS Gen2) from Purview.

    If you are connecting via Managed Identity, then make sure to add Purview Managed Identity to the Storage Blob Data Reader role for the Azure Data Lake Gen2 storage account.

    1. Navigate to your ADLS Gen2 storage account.
    2. Select Access Control (IAM) from the left navigation menu.
    3. Select + Add.
    4. Set the Role to Storage Blob Data Reader
    5. Enter your Azure Purview account name under Select input box.
    6. Then, select Save to give this role assignment to your Purview account.

    For more details, refer to Register and scan Azure Data Lake Storage Gen2 - Prerequisites.

    Check whether public network access is disabled for your storage account. If it is, consider using Managed Virtual Network IR and create a Private Endpoint to access the storage and verify that the IP address ranges of Azure Data Factory are allowed by your Azure Storage firewall settings.

    https://video2.skills-academy.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal,https://video2.skills-academy.com/en-us/azure/data-factory/managed-virtual-network-private-endpoint

    Also consider the following to troubleshoot the issue,

    1. Sometimes this issue occurs if there is something blocking the network connection. If this is the case, this issue can often be resolved by whitelisting the required endpoints as mentioned in our Microsoft documentation: https://video2.skills-academy.com/en-us/azure/azure-portal/azure-portal-safelist-urls?tabs=public-cloud#azure-portal-framework
    2. Also do check if you have all the required RBAC roles To request the user delegation key, you must assign to a security principal the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey action. The following built-in RBAC roles include the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey action, either explicitly or as part of a wildcard definition: Contributor, Storage Account Contributor, Storage Blob Data Contributor, Storage Blob Data Owner, Storage Blob Data Reader, Storage Blob Delegator. reference document: https://video2.skills-academy.com/en-us/rest/api/storageservices/create-user-delegation-sas#assign-permissions-with-rbac

    refer similar thread for reference - https://stackoverflow.com/questions/75987769/errorcode-authorizationpermissionmismatch,https://stackoverflow.com/questions/69769292/error-when-i-am-trying-to-connect-between-azure-data-factory-and-azure-data-lake.

    Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

    Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    0 comments