Skip to main content
Solved

Azure Blob Collector Unauthorized Request Error When Pulling Logs From Development Container

  • April 21, 2026
  • 9 replies
  • 2 views

mmarker
This message originated from Cribl Community Slack.
Click here to view the original link.

Hi all - I have a QQ on Azure Blob Collectors. We have databricks pushing logs into a databricks development container and files for \audit, and \query. Ive tried adhoc pull but with no success. This is set up exactly like our prod Stream -> container. Im getting the "This request is not authorized to perform this operation using this permission. Are the permissions different for when we need to pull logs in from that container rather than push into it?

Best answer by kprior

Yes, there are additional permissions required to read from the container that are worth checking. https://docs.cribl.io/stream/sources-azure-blob#azure-permissions ; you can have write permissions without read permissions so it's worth checking.

9 replies

kprior
  • Employee
  • Answer
  • April 21, 2026
Yes, there are additional permissions required to read from the container that are worth checking. https://docs.cribl.io/stream/sources-azure-blob#azure-permissions ; you can have write permissions without read permissions so it's worth checking.

mmarker
  • Author
  • Known Participant
  • April 21, 2026


Links for this message:
image.png

kprior
  • Employee
  • April 21, 2026
Hmm, okay, well, offhand I'm not sure what the issue is here. Can you send a redacted version of your JSON configuration?

mmarker
  • Author
  • Known Participant
  • April 21, 2026


Links for this message:
image.png

kprior
  • Employee
  • April 21, 2026
Hmm, can you try going into Advanced Settings and disabling Include Tags? I'm seeing some evidence that tags requries Storage Blob Data Owner permissions as well.

mmarker
  • Author
  • Known Participant
  • April 21, 2026
Ok will check - Get back soon

mmarker
  • Author
  • Known Participant
  • April 21, 2026
Kelsey - Any way we can get on a screenshare for this? The scheduled collector still hasnt picked it up :confused:

kprior
  • Employee
  • April 21, 2026
Sure, I'll DM you.

mmarker
  • Author
  • Known Participant
  • April 21, 2026
:heart: