Downloading pst files - Forbidden error

[chellooo20]

Storage Explorer Version: 1.5.0.
Platform/OS: Windows
Architecture: ia32

Bug description
Trying to download pst files uploaded with azure copy tool I am getting a forbidden error message.

Steps to Reproduce

1. Select file in blob container
2. Select download

Expected Experience
Expected outcome would be file being downloaded to local drive.

Actual Experience
Download doesn't start. REceive this error message

{
  "name": "StorageError",
  "message": "Forbidden",
  "stack": "StorageError: Forbidden\n    at Function.StorageServiceClient._normalizeError (C:\\Program Files (x86)\\Microsoft Azure Storage Explorer\\resources\\app\\node_modules\\azure-storage\\lib\\common\\services\\storageserviceclient.js:1198:23)\n    at Object.StorageServiceClient._processResponse (C:\\Program Files (x86)\\Microsoft Azure Storage Explorer\\resources\\app\\node_modules\\azure-storage\\lib\\common\\services\\storageserviceclient.js:744:50)\n    at Request.processResponseCallback [as _callback] (C:\\Program Files (x86)\\Microsoft Azure Storage Explorer\\resources\\app\\node_modules\\azure-storage\\lib\\common\\services\\storageserviceclient.js:317:37)\n    at Request.self.callback (C:\\Program Files (x86)\\Microsoft Azure Storage Explorer\\resources\\app\\node_modules\\request\\request.js:185:22)\n    at emitTwo (events.js:126:13)\n    at Request.emit (events.js:214:7)\n    at Request.<anonymous> (C:\\Program Files (x86)\\Microsoft Azure Storage Explorer\\resources\\app\\node_modules\\request\\request.js:1157:10)\n    at emitOne (events.js:116:13)\n    at Request.emit (events.js:211:7)\n    at IncomingMessage.<anonymous> (C:\\Program Files (x86)\\Microsoft Azure Storage Explorer\\resources\\app\\node_modules\\request\\request.js:1079:12)",
  "code": "Forbidden",
  "statusCode": 403,
  "requestId": "7cc012d0-601e-002c-36c3-8c5aac000000"
}

Additional Context
I connected to container using a SAS URL provided by the Office 365 console.

[craxal]

Duplicate of #970.

Sorry, missed the download differentiation.

[MRayermannMSFT]

@chellooo20 what permissions does your SAS URI have? Let me know if you need help figuring it out.

[chellooo20]

The SAS URL is the one I receive from the Office 365 Admin Console. How can I tell what permissions it comes with?

[MRayermannMSFT]

You'll need to look for the query parameter &sp. For example:

https://REDACTED.blob.core.windows.net/test01?st=2018-12-10T18%3A24%3A38Z&se=2018-12-11T18%3A24%3A38Z&sp=rl&sv=2018-03-28&sr=c&sig=REDACTED

That SAS URI has read and list permissions, because it only has an r and a l.

[chellooo20]

https://------.blob.core.windows.net/ingestiondata?sv=2015-04-05&sr=c&si=IngestionSasForAzCopy201810221206071580&sig=----

This is the one I have to work with.

[MRayermannMSFT]

Ok, that SAS URI is getting it's permissions from an ACL. We can use Storage Explorer to find out what those permissions are then! To do so, right click on your container and click "Manage Access Policies...", then look for the policy with the Id IngestionSasForAzCopy201810221206071580 and tell us what the permissions are.

[chellooo20]

I don't have the permissions to check any policies. The container is accessible from the Office 365 admin console but was not set up by us.

When I right click on the container no 'Manage Access Policies' shows up.

[MRayermannMSFT]

Ok, well it is possible that the policy does not allow for reading. Can you find someone in your organization who can check this? Also, can you see policies in the portal?

[chellooo20]

We'll try to start a ticket with Microsoft. We don't have an Azure subscription either.

[MRayermannMSFT]

@chellooo20 , were you able to make progress on this?

[MRayermannMSFT]

Closing due to lack of reply. Please open a new issue if you still have problems.