Skip to main content
Solved

Azure Blob Collector Unauthorized Request Error When Pulling Logs From Development Container

  • Apr 21, 2026 10:45 PM UTC
  • 9 replies
  • 121 views

mmarker
This message originated from Cribl Community Slack.
Click here to view the original link.

Hi all - I have a QQ on Azure Blob Collectors. We have databricks pushing logs into a databricks development container and files for \audit, and \query. Ive tried adhoc pull but with no success. This is set up exactly like our prod Stream -> container. Im getting the "This request is not authorized to perform this operation using this permission. Are the permissions different for when we need to pull logs in from that container rather than push into it?

Best answer by kprior

Yes, there are additional permissions required to read from the container that are worth checking. https://docs.cribl.io/stream/sources-azure-blob#azure-permissions ; you can have write permissions without read permissions so it's worth checking.
View original

9 replies

kprior
  • Employee
  • Answer
  • Apr 21, 2026 10:45 PM UTC
Yes, there are additional permissions required to read from the container that are worth checking. https://docs.cribl.io/stream/sources-azure-blob#azure-permissions ; you can have write permissions without read permissions so it's worth checking.

mmarker
  • Author
  • Known Participant
  • Apr 21, 2026 10:45 PM UTC


Links for this message:
image.png

kprior
  • Employee
  • Apr 21, 2026 10:45 PM UTC
Hmm, okay, well, offhand I'm not sure what the issue is here. Can you send a redacted version of your JSON configuration?

mmarker
  • Author
  • Known Participant
  • Apr 21, 2026 10:45 PM UTC


Links for this message:
image.png

kprior
  • Employee
  • Apr 21, 2026 10:45 PM UTC
Hmm, can you try going into Advanced Settings and disabling Include Tags? I'm seeing some evidence that tags requries Storage Blob Data Owner permissions as well.

mmarker
  • Author
  • Known Participant
  • Apr 21, 2026 10:45 PM UTC
Ok will check - Get back soon

mmarker
  • Author
  • Known Participant
  • Apr 21, 2026 10:46 PM UTC
Kelsey - Any way we can get on a screenshare for this? The scheduled collector still hasnt picked it up :confused:

kprior
  • Employee
  • Apr 21, 2026 10:46 PM UTC
Sure, I'll DM you.

mmarker
  • Author
  • Known Participant
  • Apr 21, 2026 10:46 PM UTC
:heart: