> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maia.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Storage authorization permission mismatch

> Resolve the Azure Storage error returned when your credentials don't carry the right permission for an operation.

## Error message

```text wrap theme={null}
AuthorizationPermissionMismatch: This request is not authorized to perform this operation using this permission.
```

This error can appear when using the following components: [Azure Blob Storage Load](https://docs.maia.ai/docs/components/azure-blob-storage-load.md) and [Data Transfer](https://docs.maia.ai/docs/components/data-transfer.md).

### Explanation

Azure Storage rejected the request because the credentials your Maia runner used don't carry the right permission for that operation, or the signature on the request couldn't be verified.

### Potential causes

* The identity has no data-plane role on the storage account or container. A management role such as Owner isn't enough.
* A shared access signature (SAS) token is expired, was created with the wrong permissions, or covers the wrong container.
* The storage account key or SAS was rotated and the saved credential is out of date. This produces `Signature did not match`.
* A storage firewall or private endpoint rule blocks the Maia runner's network.

***

## Resolve the error

1. Identify which operation failed (read, write, or list) and which container the component uses.
2. For identity-based access, assign Storage Blob Data Reader (read) or Storage Blob Data Contributor (write) at the storage account or container scope.
3. For SAS tokens, generate a new token with the permissions the component needs (read, write, list), a valid start and expiry time, and the correct container.
4. If the message says `Signature did not match`, [update the saved secret](https://docs.maia.ai/docs/guides/secrets-and-secret-definitions.md) in Maia with the current key or SAS value.
5. Check that the storage account's networking settings allow traffic from your Maia runner.
6. Role assignments can take a few minutes to apply. Re-run the pipeline afterward.
7. If you still need help, [contact Maia Support](https://support.matillion.com/s/) and include the items listed below.

   * The storage account and container names.
   * Whether the Maia runner uses a SAS token, account key, or managed identity.

### Prevent future errors

To prevent this error occurring again:

* [Prefer managed identities](https://docs.maia.ai/docs/guides/azure-managed-identity.md) over long-lived keys.
* Set a reminder to rotate SAS tokens before they expire.


## Related topics

- [Not authorized to perform an action on an AWS resource](https://docs.maia.ai/docs/errors/not-authorized-to-perform-an-action-on-an-aws-resource.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.