# Permissions to Create Azure Blob and Container

**URL:** <https://forum.ansible.com/t/permissions-to-create-azure-blob-and-container/22095>\
**Category:** Ansible Project\
**Tags:** azure\
**Created:** [July 22, 2016, 7:36pm UTC](https://forum.ansible.com/t/permissions-to-create-azure-blob-and-container/22095 "2016-07-22T19:36:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![barrett](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@barrett](https://forum.ansible.com/u/barrett)\
**Post date:** [July 22, 2016, 7:36pm UTC](https://forum.ansible.com/t/permissions-to-create-azure-blob-and-container/22095/1 "2016-07-22T19:36:45Z")

</div>

Hello all,

I’m attempting to use the azure\_rm functionality I appear to be having an issue

I have an action like

```auto
- name:
  azure_rm_storageblob:
    resource_group: MY_COMPANY
    storage_account_name: testdeletemebnr
    container: grid
    blob: 0.0.2-SNAPSHOT.jar
    tenant: redacted
    client_id: 8e71ddb2-d794-4f7c-9ed7-60e6b301c794
    secret: redacted
    subscription_id: redacted
    src: /tmp/azure_ansible
    state: present
  tags: [azure_test]

```

I receive back the output

TASK [telemetry : None] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [remote\_host]: FAILED! =\> {“changed”: false, “failed”: true, “msg”: “One-time registration of Microsoft.Storage failed - The client ‘d38eaaca-1429-44ef-8ce2-3c63a62849c9’ with object id ‘d38eaaca-1429-44ef-8ce2-3c63a62849c9’ does not have authorization to perform action ‘Microsoft.Storage/register/action’ over scope ‘/subscriptions/\*\*\*\*\*\*\*\*’.”}  
to retry, use: --limit @cloud\_entry.retry

From the azure cli I run

> role assignment list command

data: RoleDefinitionName : Contributor  
data: RoleDefinitionId : b24988ac-6180-42a0-ab88-20f7382dd24c  
data: Scope : /subscriptions/redacted/resourceGroups/MY\_COMPANY/providers/Microsoft.Storage/storageAccounts/testdeletemebnr  
data: Display Name : jar-deploy  
data: SignInName :  
data: ObjectId : d38eaaca-1429-44ef-8ce2-3c63a62849c9  
data: ObjectType : ServicePrincipal

Things I noted the objectId and the clientId in the error message are identical. Should that be the case? My expectation is the client\_id should be the one I entered.

I do see that the objectId in the error message is equal to the one in my role assignment.

My ServicePrincipal has Contributor RBAC’s on the storage account testdeletemebnr as shown by assignment list.

Any thoughts on if this is an Azure issue, my issue or Ansible issue?

Thank you very much!

-b

---

<div class="post-metadata">

**Author:** ![Anthony\_Cheng](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@Anthony\_Cheng](https://forum.ansible.com/u/Anthony_Cheng)\
**Post date:** [July 23, 2016, 6:58pm UTC](https://forum.ansible.com/t/permissions-to-create-azure-blob-and-container/22095/2 "2016-07-23T18:58:57Z")

</div>

Try using debug -vvv and then manually run the command that fails; that should give you some clues as to what kind of issue.