MetricSign
EN|NLRequest Access
Medium severitydata flow

Power BI Refresh Error:
DF-Executor-UnreachableStorageAccount

What does this error mean?

The data flow cannot establish a network connection to the storage account. A firewall rule, private endpoint misconfiguration, or DNS resolution failure is preventing the Azure IR or self-hosted IR from reaching the storage account's endpoint.

Common causes

  • 1The storage account's firewall is set to 'Selected networks' and the Azure Integration Runtime's IP range or the managed VNet is not in the allowed network list
  • 2A private endpoint is configured but the private DNS zone is not linked to the Azure IR's virtual network — DNS resolves to a public IP that is blocked
  • 3A self-hosted integration runtime is used and the corporate firewall or proxy blocks outbound HTTPS traffic to the storage account's FQDN (accountname.blob.core.windows.net)
  • 4The storage account name in the linked service is incorrect or the account was deleted — DNS lookup for a non-existent account also results in an unreachable error

How to fix it

  1. 1In the Azure portal, open the storage account's Networking blade and check whether 'Selected networks' or 'Disabled' is set — if restricted, add the Azure Integration Runtime's subnet or enable 'Allow trusted Microsoft services'.
  2. 2If using a private endpoint, confirm the private DNS zone is correctly linked to the Azure IR's virtual network — a missing DNS link causes the storage account hostname to resolve to a public IP that is blocked.
  3. 3Test connection the storage linked service in ADF — if it fails, the error message specifies whether the failure is DNS, TCP, or authentication.
  4. 4If using a Self-Hosted IR, verify the SHIR host machine can reach the storage account's FQDN (e.g., accountname.blob.core.windows.net) from the machine's network — corporate firewalls often block Azure storage endpoints.
  5. 5Check whether the storage account name in the linked service is correct and the account exists in the expected subscription — a deleted or renamed storage account also produces this error.

Frequently asked questions

How do I test network connectivity from the Azure IR to a storage account?

Click 'Test connection' on the linked service — it reports whether the failure is DNS, TCP, or authentication. For self-hosted IR, run `nslookup accountname.blob.core.windows.net` and `Test-NetConnection -ComputerName accountname.blob.core.windows.net -Port 443` from the SHIR host.

We enabled a private endpoint — why is it still unreachable?

A private endpoint alone isn't enough — you also need a private DNS zone (privatelink.blob.core.windows.net) linked to the IR's virtual network. Without it, the hostname resolves to the public IP.

What is the quickest fix for a storage firewall blocking ADF?

Enable 'Allow trusted Microsoft services' in the storage account Networking blade to let the Azure IR bypass the firewall without IP whitelisting. For SHIR or strict-compliance environments, add the IR's outbound IPs to the allow list.

Will downstream Power BI datasets be affected?

Yes — the pipeline fails immediately without reading any data. Dependent datasets and reports serve stale figures until the network connectivity issue is resolved.

Official documentation: https://learn.microsoft.com/en-us/azure/data-factory/data-flow-troubleshoot-guide

Other data flow errors