Error message
Explanation
Azure Storage rejected the request because the credentials your Maia runner used don’t carry the right permission for that operation, or the signature on the request couldn’t be verified.Potential causes
- The identity has no data-plane role on the storage account or container. A management role such as Owner isn’t enough.
- A shared access signature (SAS) token is expired, was created with the wrong permissions, or covers the wrong container.
- The storage account key or SAS was rotated and the saved credential is out of date. This produces
Signature did not match. - A storage firewall or private endpoint rule blocks the Maia runner‘s network.
Resolve the error
- Identify which operation failed (read, write, or list) and which container the component uses.
- For identity-based access, assign Storage Blob Data Reader (read) or Storage Blob Data Contributor (write) at the storage account or container scope.
- For SAS tokens, generate a new token with the permissions the component needs (read, write, list), a valid start and expiry time, and the correct container.
-
If the message says
Signature did not match, update the saved secret in Maia with the current key or SAS value. - Check that the storage account’s networking settings allow traffic from your Maia runner.
- Role assignments can take a few minutes to apply. Re-run the pipeline afterward.
-
If you still need help, contact Maia Support and include the items listed below.
- The storage account and container names.
- Whether the Maia runner uses a SAS token, account key, or managed identity.
Prevent future errors
To prevent this error occurring again:- Prefer managed identities over long-lived keys.
- Set a reminder to rotate SAS tokens before they expire.