Share via

Have there been changes to how ADF web activities access blob storage while authorized via SAMI?

Juho Paavola 0 Reputation points
2025-03-13T07:33:42.9733333+00:00

We have an Azure Data Factory pipeline that includes a Web Activity, which writes data directly to an Azure Blob Storage container. This Web Activity is configured to use System-Assigned Managed Identity for authentication against the Blob Storage account, uses PUT method with a body from earlier linked activity, the resource is set to https://storage.azure.com/ and has the headers set as x-ms-blob-type = BlockBlob and x-ms-version = 2017-11-09.

This setup was working successfully until February 21, 2025 (last successful run), and no changes were made on our end to the pipeline, Storage Account, RBAC permissions, or network/firewall configurations. On March 6th, I tried running the Web Activity and it failed with an "AuthorizationFailure: This request is not authorized to perform this operation." error, and has done so since. Our settings for the storage account (which, once again, worked up until Feb 21st) are as follows:

  • The ADF instance has Storage Blob Data Contributor role on the Storage Account.
  • Networking settings:
    • Public network access is enabled for selected virtual networks and IP addresses (specifically, our internal office network and VPN access).
    • We have allowed Microsoft.DataFactory/factories as Resource Instances in the current subscription.
    • The "Allow Azure services on the trusted services list to access this storage account" exception is enabled.
    • Microsoft network routing is used (no Private Endpoints).

Tests Performed

  • We confirmed Copy Data Activities and Data Flows in the same ADF instance that link to the same Blob Storage still work with System-Assigned Managed Identity, which suggests RBAC is correctly configured.
  • We tested different x-ms-version headers (no change).
  • We tested the Web Activity while:
    • Enabling all public access to the Blob Storage container (successful).
    • Adding Storage Blob Data Owner role to SAMI (no change).
  • We implemented an User-Assigned Managed Identity and configured the same Web Activity to authenticate with it. This worked successfully, allowing the Web Activity to write to Blob Storage.

My question specifically at this time is whether there have been any recent changes to the handling of System-Assigned Managed Identities, Trusted Microsoft Services, or firewall/network enforcement for Azure Data Factory and Blob Storage interactions, and whether a shift to using User-Assigned Managed Identities would be the recommended practice for ADF Web/HTTP Activities that interact with network-restricted Storage Accounts?

Azure Data Factory
Azure Data Factory
An Azure service for ingesting, preparing, and transforming data at scale.
11,343 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Amira Bedhiafi 29,711 Reputation points
    2025-03-13T09:49:56.3533333+00:00

    In March 2024, Microsoft implemented a security update that impacts ADF's interactions with Azure Storage accounts and Azure Key Vault when using managed identities and firewall exceptions for trusted services.

    https://learn.microsoft.com/en-us/answers/questions/1838277/data-factory-managed-identity-is-not-being-identif

    This update may cause authorization failures in scenarios where ADF Web Activities, authenticated via SAMI, attempt to access Blob Storage accounts that have network restrictions in place, even if the "Allow trusted Microsoft services to access this storage account" setting is enabled. The security patch enforces stricter access controls, potentially leading to the "AuthorizationFailure: This request is not authorized to perform this operation." error you've encountered.

    https://learn.microsoft.com/en-us/answers/questions/255948/getting-authorizationfailure-when-using-managed-id

    As you've observed, configuring the Web Activity to authenticate using a UAMI allows successful access to Blob Storage. UAMIs provide more granular control over identity lifecycle and permissions, which can help in scenarios with strict network restrictions.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.