Unable to update Azure Storage Account minimum TLS version: Error: Managed Service Identity (MSI) was not found for resource ''

Question

Unable to update Azure Storage Account minimum TLS version: Error: Managed Service Identity (MSI) was not found for resource ''

Thomas Levesque 101

Following the announcement about the retirement of TLS 1.0 and 1.1 support, I tried to update the minimum TLS version on one of my storage accounts to 1.2 (via the Azure Portal).

It failed with the following error:

Failed to update storage account '(redacted)'. Error: Managed Service Identity (MSI) was not found for resource ''.

As far as I can tell, there's nothing special about this storage account. Here are its main properties:

User's image

I have successfully updated all my other storage accounts, the error only occurs for this one.

I tried to update it via PowerShell, but it gave the same error.

Any idea what could be causing this and how to fix it?

Thanks

Syed Aaqid Ali 585 Reputation points Microsoft External Staff Volunteer Moderator

2025-01-30T13:10:23.27+00:00
Hi Thomas Levesque,

Welcome to Microsoft Q&A forum! Thanks for posting your query!

The error message "Managed Service Identity (MSI) was not found for resource" typically indicates that the Managed Identity associated with your Azure Storage Account is either not enabled or not properly configured. Here are a few steps you can take to troubleshoot and potentially resolve the issue:

Verify that the Managed Identity has the necessary permissions to update the storage account. It should have the required roles assigned, such as Storage Account Contributor.

If the Managed identity is not in use for the storage account, could you please remove or delete it from the storage account.

Kindly let me know if this helps!
Thomas Levesque 101 Reputation points

2025-01-30T21:05:30.5533333+00:00

@Syed Aaqid Ali Thanks for your reply.

Verify that the Managed Identity has the necessary permissions to update the storage account. It should have the required roles assigned, such as Storage Account Contributor. If the Managed identity is not in use for the storage account, could you please remove or delete it from the storage account.

How do I do that? As far as I know there's no managed identity associated with a storage account?
I never did anything related to managed identity to that storage account. Or any other storage account, for that matter, but I didn't have any issue updating the others.

I'm really confused about this... also, the error message clearly looks like a bug, it refers to resource '' (empty string).
Syed Aaqid Ali 585 Reputation points Microsoft External Staff Volunteer Moderator

2025-01-31T12:24:12.72+00:00

Hi Thomas Levesque,

You can verify this through the Azure Portal by selecting the relevant storage account and navigating to the Access Control blade. Under the Access Control section, select the "Role Assignments" tab to check if any Managed Service Identity (MSI) is assigned to the storage account. Please refer to the screenshot below for further clarification.

You can also click on the "Check Access" column to view the authorization details for your access to this storage account

To delete the Managed Identity on the storage account, select the checkbox next to the Managed Identity and click "Delete" at the top. Please note that removing the MSI will revoke all user access associated with this storage account through the MSI.
Thomas Levesque 101 Reputation points

2025-01-31T13:07:28.2166667+00:00

There isn't a managed identity. Just me, the owner
Thomas Levesque 101 Reputation points

2025-02-05T08:29:43.4666667+00:00

@Syed Aaqid Ali any idea?
Syed Aaqid Ali 585 Reputation points Microsoft External Staff Volunteer Moderator

2025-02-05T18:38:05.4666667+00:00

Hi Thomas,

I apologize for delay in response. I will keep you posted.
Anonymous

2025-02-07T08:14:03.71+00:00
Hi Thomas Levesque

I apologize for the delay in my response

Could you please confirm whether you are getting a managed identity using the following command?

(Get-AzStorageAccount -ResourceGroupName "<your-resource-group>" -Name "<your-storage-account>").Identity
Thomas Levesque 101 Reputation points

2025-02-07T08:48:34.7566667+00:00

Thanks for your reply!

Here's what I get:
Anonymous

2025-02-07T10:29:57.3066667+00:00
@Thomas Levesque

Please use this below command to remove the managed identity from storage account

Set-AzStorageAccount -ResourceGroupName "<resource grp name>" -Name "<Storage account name>" -IdentityType None

and try setting the TLS version again.

Kindly let me know if this helps!
Thomas Levesque 101 Reputation points

2025-02-07T10:44:29.46+00:00

Thanks, I'll try that. However, this storage account is linked to an Azure Functions app. Isn't it going to cause issues?
Thomas Levesque 101 Reputation points

2025-02-07T10:48:55.79+00:00

It worked. Thank you very much, sir!

I was afraid it might break the Azure Functions app that depended on it, but apparently not.

Answer accepted by question author

0 additional answers

Your answer

Syed Aaqid Ali 585 Reputation points Microsoft External Staff Volunteer Moderator

2025-01-30T13:10:23.27+00:00

Hi Thomas Levesque,

Welcome to Microsoft Q&A forum! Thanks for posting your query!

The error message "Managed Service Identity (MSI) was not found for resource" typically indicates that the Managed Identity associated with your Azure Storage Account is either not enabled or not properly configured. Here are a few steps you can take to troubleshoot and potentially resolve the issue:

Verify that the Managed Identity has the necessary permissions to update the storage account. It should have the required roles assigned, such as Storage Account Contributor.

If the Managed identity is not in use for the storage account, could you please remove or delete it from the storage account.

Kindly let me know if this helps!
Thomas Levesque 101 Reputation points

2025-01-30T21:05:30.5533333+00:00

@Syed Aaqid Ali Thanks for your reply.

Verify that the Managed Identity has the necessary permissions to update the storage account. It should have the required roles assigned, such as Storage Account Contributor. If the Managed identity is not in use for the storage account, could you please remove or delete it from the storage account.

How do I do that? As far as I know there's no managed identity associated with a storage account?
I never did anything related to managed identity to that storage account. Or any other storage account, for that matter, but I didn't have any issue updating the others.

I'm really confused about this... also, the error message clearly looks like a bug, it refers to resource '' (empty string).
Syed Aaqid Ali 585 Reputation points Microsoft External Staff Volunteer Moderator

2025-01-31T12:24:12.72+00:00

Hi Thomas Levesque,

You can verify this through the Azure Portal by selecting the relevant storage account and navigating to the Access Control blade. Under the Access Control section, select the "Role Assignments" tab to check if any Managed Service Identity (MSI) is assigned to the storage account. Please refer to the screenshot below for further clarification.

You can also click on the "Check Access" column to view the authorization details for your access to this storage account

To delete the Managed Identity on the storage account, select the checkbox next to the Managed Identity and click "Delete" at the top. Please note that removing the MSI will revoke all user access associated with this storage account through the MSI.
Thomas Levesque 101 Reputation points

2025-01-31T13:07:28.2166667+00:00

There isn't a managed identity. Just me, the owner
Thomas Levesque 101 Reputation points

2025-02-05T08:29:43.4666667+00:00

@Syed Aaqid Ali any idea?
Syed Aaqid Ali 585 Reputation points Microsoft External Staff Volunteer Moderator

2025-02-05T18:38:05.4666667+00:00

Hi Thomas,

I apologize for delay in response. I will keep you posted.
Anonymous

2025-02-07T08:14:03.71+00:00

Hi Thomas Levesque

I apologize for the delay in my response

Could you please confirm whether you are getting a managed identity using the following command?

(Get-AzStorageAccount -ResourceGroupName "<your-resource-group>" -Name "<your-storage-account>").Identity
Thomas Levesque 101 Reputation points

2025-02-07T08:48:34.7566667+00:00

Thanks for your reply!

Here's what I get:
Anonymous

2025-02-07T10:29:57.3066667+00:00

@Thomas Levesque

Please use this below command to remove the managed identity from storage account

Set-AzStorageAccount -ResourceGroupName "<resource grp name>" -Name "<Storage account name>" -IdentityType None

and try setting the TLS version again.

Kindly let me know if this helps!
Thomas Levesque 101 Reputation points

2025-02-07T10:44:29.46+00:00

Thanks, I'll try that. However, this storage account is linked to an Azure Functions app. Isn't it going to cause issues?
Thomas Levesque 101 Reputation points

2025-02-07T10:48:55.79+00:00

It worked. Thank you very much, sir!

I was afraid it might break the Azure Functions app that depended on it, but apparently not.

Answer 1

Hi Thomas Levesque

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

Posting as solution, After deleting the managed identity was able to resolve the issue.

Command:

(Get-AzStorageAccount -ResourceGroupName "<your-resource-group>" -Name "<your-storage-account>").Identity 
Set-AzStorageAccount -ResourceGroupName "<resource grp name>" -Name "<Storage account name>" -IdentityType None

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community member