Insufficient read or write permissions on storage account

[sabmayahai]

Tried enabling sql auditing using cli, it failed with error "Insufficient read or write permissions on storage account '<storage_account_name>'"

While the corresponding powershell command worked.

AZ CLI Command: [Did not work]

az sql db audit-policy update --name <db_name> --resource-group <rg_name> --server <sql_server_name> --retention-days 30 --storage-account <storage_account_name> --state Enabled --action SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP FAILED_DATABASE_AUTHENTICATION_GROUP

POWERSHELL Command [Worked]

Set-AzSqlDatabaseAudit -ResourceGroupName "<rg_name>" -ServerName "<sql_server_name>" -DatabaseName "<db_name>" -BlobStorageTargetState Enabled -StorageAccountResourceId "/subscriptions/***************/resourceGroups/<blob_rg_name>/providers/Microsoft.Storage/storageAccounts/<storage_account_name>" -AuditActionGroup SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP -RetentionInDays 30

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 4f158476-a880-5ae8-8b05-dc0dbe37b4a0
• Version Independent ID: c02a5c94-c6e5-e93f-1639-cde7b65f5702
• Content: az sql db audit-policy
• Content Source: src/azure-cli/azure/cli/command_modules/sql/_help.py
• Service: sql-database
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @azureSQLGitHub.

[yonzhan]

sql

[taimish]

Is there any update? I have the same issue:

az sql server audit-policy update `
--name $ssName `
--state 'Enabled' `
--blob-storage-target-state 'Enabled' `
--retention-days '181' `
--actions 'BATCH_COMPLETED_GROUP' 'SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP' 'FAILED_DATABASE_AUTHENTICATION_GROUP' `
--storage-account $storageAccountName `
--resource-group $resourceGroup `
--subscription $subscription

The output is the same: Insufficient read or write permissions on storage account 'sapcpqdevsa'

I tried adding the bypass parameter: --bypass 'AzureServices' or --bypass 'Logging but that didn't help. I found a recommendation to allow access from all networks in the Firewall configuration, but that is not an appropriate option for some situation.

[yonzhan]

sql service team should look into this.

[aroca-opengov]

mm.. i am still with this issue. Its being a long time. Have you found any solution?

Thanks!