What causes DF-Executor-UnauthorizedStorageAccess?

The ADF managed identity lacks the 'Storage Blob Data Reader' role on the source storage account or the 'Storage Blob Data Contributor' role on the sink storage account. A SAS token used by the linked service has expired or was revoked — SAS tokens have a hard expiry date and silently stop working after it. The storage account was recently moved to a different resource group or subscription, invalidating the existing RBAC role assignments. A self-hosted integration runtime is used and the machine's local identity or the service account configured in the linked service does not have storage access

How do I fix DF-Executor-UnauthorizedStorageAccess?

In the Azure portal, go to the storage account's Access Control (IAM) and verify the data flow's managed identity or service principal has 'Storage Blob Data Reader' (for source) or 'Storage Blob Data Contributor' (for sink) role.. If using a self-hosted IR, the IR host machine's identity or the credentials configured in the linked service must have storage access — check both the linked service authentication settings and the RBAC assignments.. Verify that the storage account firewall is not blocking the Azure IR IP addresses — if the storage account has 'Selected networks' enabled, add the ADF integration runtime's public IPs or enable 'Allow trusted Microsoft services'.. If using SAS token authentication, confirm the SAS token has not expired and includes the required permissions (read, write, list) for the relevant containers.. Test connection the storage linked service after updating permissions — permission changes can take up to 5 minutes to propagate.

Medium severitydata flow

Power BI Refresh Error:
DF-Executor-UnauthorizedStorageAccess

What does this error mean?

The data flow identity does not have permission to access the storage account. The managed identity, service principal, or SAS token used by the linked service is missing the required RBAC role on the storage account or container.

Common causes

1The ADF managed identity lacks the 'Storage Blob Data Reader' role on the source storage account or the 'Storage Blob Data Contributor' role on the sink storage account
2A SAS token used by the linked service has expired or was revoked — SAS tokens have a hard expiry date and silently stop working after it
3The storage account was recently moved to a different resource group or subscription, invalidating the existing RBAC role assignments
4A self-hosted integration runtime is used and the machine's local identity or the service account configured in the linked service does not have storage access

How to fix it

1In the Azure portal, go to the storage account's Access Control (IAM) and verify the data flow's managed identity or service principal has 'Storage Blob Data Reader' (for source) or 'Storage Blob Data Contributor' (for sink) role.
2If using a self-hosted IR, the IR host machine's identity or the credentials configured in the linked service must have storage access — check both the linked service authentication settings and the RBAC assignments.
3Verify that the storage account firewall is not blocking the Azure IR IP addresses — if the storage account has 'Selected networks' enabled, add the ADF integration runtime's public IPs or enable 'Allow trusted Microsoft services'.
4If using SAS token authentication, confirm the SAS token has not expired and includes the required permissions (read, write, list) for the relevant containers.
5Test connection the storage linked service after updating permissions — permission changes can take up to 5 minutes to propagate.

Frequently asked questions

How do I check which RBAC roles are assigned to the ADF managed identity?

In the Azure portal, go to storage account > Access Control (IAM) > Role assignments and filter by the ADF instance name. Verify it has Storage Blob Data Reader (source) or Contributor (sink) assigned.

We use a SAS token for authentication — how do I check if it expired?

Find the 'se=' parameter in the SAS token. If it has expired, generate a new token from the storage account's Shared access signature blade and update the linked service.

Why did this start failing after we moved the storage account to a new resource group?

Moving a resource group invalidates RBAC assignments at that scope. Storage-account-level assignments are preserved, but resource-group-level assignments are not transferred — re-assign them at the storage account level.

Will downstream Power BI datasets be affected?

Yes — the pipeline fails immediately without reading or writing any data. Dependent datasets serve stale figures until access is restored.

Official documentation: https://learn.microsoft.com/en-us/azure/data-factory/data-flow-troubleshoot-guide