Azure Machine Learning compute instances in workspace fail to provision due to a storage mount permissions error.

The customer is facing a storage mount failure with the error:

Failed to mount storage due to permissions issue Make sure the identity has the right permissions like Storage File Privileged Contributor

This error occurs during compute/container creation and leads to repeated retries, even though the service returns HTTP 500 errors.

Findings:

The storage mount failure initially appeared to be an RBAC permission issue.

1. The identity is a Managed Identity (MSI).
2. The required role Storage File Privileged Contributor is a data‑plane role, which is often not granted by default to customer user identities.
3. Customers typically only have control‑plane roles, so both of the following must be verified:
   • The workspace Managed Identity (MSI) has the data‑plane role.
   • The customer’s user identity also has the same role assigned on the storage account (via IAM).

Further investigation revealed the actual blocking factor was Network Security Perimeter (NSP) restrictions on the storage account.

• Error observed: Microsoft.Azure.Storage.StorageException: This request is not authorized by network security perimeter to perform this operation
• Even with correct RBAC permissions, NSP rules were denying access from the workspace Managed Identity.
• As a result, container creation kept retrying continuously, amplifying the issue.

Customer Actionability

• The customer can fully self‑serve:
  • Verify RBAC (data‑plane roles) on the storage account.
  • Review and adjust NSP rules using diagnostics.

NSP creation link :
Quickstart - Create a network security perimeter - Azure portal - Azure Private Link | Microsoft Le…

Diagnostic logs :
Diagnostic logs for Network Security Perimeter - Azure Private Link | Microsoft Learn.

Thanks,
Manish.

Hi Mark Simpson,

Thanks for sharing the detailed symptoms.

This doesn’t look compute‑instance specific. Since multiple newly created compute instances fail with the same storage mount error, and the managed identity already has the required RBAC roles on the workspace storage account, it points more toward a workspace‑level or backend issue rather than a misconfiguration on an individual compute.

A few observations based on the details you shared:

The error consistently occurs during storage mount, even after recreating compute instances.

Required roles such as Storage Blob Data Contributor and Storage File Data Privileged Contributor are already assigned.

The workspace is using systemDatastoresAuthMode = identity, and switching storage‑side settings (including key‑based access) didn’t change the behavior.

Please let me know if the issue persists after these checks. If you have any remaining questions or need additional details, I’ll be glad to provide further clarification or guidance. If the above steps resolve your issue, kindly confirm.

Thankyou!