Unable to add service principle, groups to the $logs container in ADLS2

Question

Recently enabled storage analytics on ADLS Gen2 storage account.I can see the $logs container and the logs are writing to this on an hourly basis. But when I'm trying to add service principal to this container getting permission denied. I have storage data contributor role on this storage account, any special permission is required to achieve this?

Answer 1

In general, being able to manage IAM requires higher level roles to be granted to your account. I assume, that you're trying to grant access via Access Control (IAM) feature / API call. Using Storage Data Contributor is not sufficient as it only allows you to access containers and blobs with read / write / delete access.

You need a role which grants you Microsoft.Authorization/*/write permission in order to get it working.

Answer 2

The problem is resolved by adding the SP/groups from the portal at the container level instead of storage explorer.