Authenticate Azure Storage Files using Microsoft Entra ID

Saurabh Bhandari
Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

@venkatesan s I am getting this error:

Exception in thread "main" com.azure.storage.file.share.models.ShareStorageException: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.

If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.

Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.

If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.

If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.

Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.

Status code 403, "?<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.

RequestId:eac08e77-601a-0061-51f7-b7b1a3000000

Time:2025-04-28T04:42:50.7432096Z</Message></Error>

I am using the below code, and the same privileges you have assigned are assigned to the storage account

TokenCredential tokenCredential = new ClientSecretCredentialBuilder()
          .clientId("id") 
          .clientSecret("secret") 
          .tenantId("tenantid")  
          .build();
ShareServiceClient serviceClient = new ShareServiceClientBuilder()
          .endpoint(fileShareUrl)
          .credential(tokenCredential)
          .shareTokenIntent(ShareTokenIntent.BACKUP)
          .buildClient();
 ShareClient shareClient = serviceClient.getShareClient("files");
      String fileName = "testfile.txt";
      ShareFileClient fileClient = shareClient.getFileClient(fileName);
      byte[] fileContent = "Hello, Azure File Share!".getBytes(StandardCharsets.UTF_8);
      long fileSize = fileContent.length;
       fileClient = shareClient.createFile(fileName,
         fileSize);
      fileClient.upload(new ByteArrayInputStream(Base64.decodeBase64(fileContent)),
          Base64.decodeBase64(fileContent).length, new ParallelTransferOptions());
      System.out.println("File uploaded successfully!");

Can you help me understand why this error is occurring in my case?

Hi Saurabh Bhandari

• First, use shareClient.getRootDirectoryClient().getFileClient(fileName).
• Then call .create(fileSize).
• Then .upload() the content.

@venkatesan s I have updated the code as you said, and I am getting the same error:

ShareServiceClient serviceClient = new ShareServiceClientBuilder().endpoint(fileShareUrl)
        .credential(tokenCredential).shareTokenIntent(ShareTokenIntent.BACKUP).buildClient();
    ShareClient shareClient = serviceClient.getShareClient("files");
    String fileName = "testfile.txt";
    ShareFileClient fileClient = shareClient.getRootDirectoryClient().getFileClient(fileName);
    byte[] content = "Hello, Azure File Share!".getBytes(StandardCharsets.UTF_8);
    fileClient.create(content.length);
    ByteArrayInputStream inputStream = new ByteArrayInputStream(content);
    fileClient.upload(inputStream, content.length, new ParallelTransferOptions());
    System.out.println("File uploaded successfully!");

Here is my full code and dependency:

import com.azure.identity.ClientSecretCredential;
import com.azure.identity.ClientSecretCredentialBuilder;
import com.azure.storage.common.ParallelTransferOptions;
import com.azure.storage.file.share.*;
import com.azure.storage.file.share.models.ShareFileItem;
import com.azure.storage.file.share.models.ShareTokenIntent;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.nio.charset.StandardCharsets;

public class App {

    public static void main(String[] args) {
        // Entra ID credentials and storage details
        String tenantId = "xxxx";
        String clientId = "xxxxx;
        String clientSecret = "xxxx";
        String storageAccountName = "xxxxxx";
        String fileShareUrl = String.format("https://%s.file.core.windows.net", storageAccountName);
        String shareName = "share1";
        String fileName = "testfile.txt";

        // Authenticate using Microsoft Entra ID
        ClientSecretCredential credential = new ClientSecretCredentialBuilder()
                .tenantId(tenantId)
                .clientId(clientId)
                .clientSecret(clientSecret)
                .build();

        // Build the service client
        ShareServiceClient serviceClient = new ShareServiceClientBuilder()
                .endpoint(fileShareUrl)
                .credential(credential)
                .shareTokenIntent(ShareTokenIntent.BACKUP)
                .buildClient();

        // Create and upload a file
        ShareClient shareClient = serviceClient.getShareClient(shareName);
        ShareFileClient fileClient = shareClient.getRootDirectoryClient().getFileClient(fileName);
        byte[] content = "Hello from Microsoft Entra ID!".getBytes(StandardCharsets.UTF_8);
        fileClient.create(content.length);
        ByteArrayInputStream inputStream = new ByteArrayInputStream(content);
        ParallelTransferOptions options = new ParallelTransferOptions()
               .setBlockSizeLong(4 * 1024 * 1024L)
               .setMaxConcurrency(2);
        fileClient.upload(inputStream, content.length, options);
        System.out.println("File created and uploaded: " + fileName);

        // Download file
        ByteArrayOutputStream stream = new ByteArrayOutputStream();
        fileClient.download(stream);
        System.out.printf("Completed downloading the file with content: %n%s%n%n",
                new String(stream.toByteArray(), StandardCharsets.UTF_8));

        // Recursive listing
        System.out.println("Recursively listing all files and folders:");
        listFilesRecursively(shareClient.getRootDirectoryClient(), "");

        // Delete file
        fileClient.delete();
        System.out.println("File deleted: " + fileName);
    }

    // Recursive listing helper
    public static void listFilesRecursively(ShareDirectoryClient directoryClient, String path) {
        for (ShareFileItem item : directoryClient.listFilesAndDirectories()) {
            String fullPath = path.isEmpty() ? item.getName() : path + "/" + item.getName();
            if (item.isDirectory()) {
                System.out.println("Directory: " + fullPath);
                ShareDirectoryClient subDirClient = directoryClient.getSubdirectoryClient(item.getName());
                listFilesRecursively(subDirClient, fullPath);
            } else {
                System.out.println("File: " + fullPath);
            }
        }
    }
}

Pom.xml:

 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-storage-file-share</artifactId>
     <version>12.21.4</version>
 </dependency>
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
     <version>1.13.1</version>
  </dependency>

Please try to run the above code in your environment with proper share name, clientid, tenantid, client secret.