[BUG] cloudshell issue new-AZStroageContainer not working

[jileary23]

To Reproduce

# Sign in to your Azure account.
Connect-AzAccount

# Set variables.
$rgName = "<resource-group>"
$srcAccountName = "<source-storage-account>"
$destAccountName = "<destination-storage-account>"
$srcContainerName1 = "source-container1"
$destContainerName1 = "dest-container1"
$srcContainerName2 = "source-container2"
$destContainerName2 = "dest-container2"

# Enable blob versioning and change feed on the source account.
Update-AzStorageBlobServiceProperty -ResourceGroupName $rgName `
    -StorageAccountName $srcAccountName `
    -EnableChangeFeed $true `
    -IsVersioningEnabled $true

# Enable blob versioning on the destination account.
Update-AzStorageBlobServiceProperty -ResourceGroupName $rgName `
    -StorageAccountName $destAccountName `
    -IsVersioningEnabled $true

# List the service properties for both accounts.
Get-AzStorageBlobServiceProperty -ResourceGroupName $rgName `
    -StorageAccountName $srcAccountName
Get-AzStorageBlobServiceProperty -ResourceGroupName $rgName `
    -StorageAccountName $destAccountName

# Create containers in the source and destination accounts.
Get-AzStorageAccount -ResourceGroupName $rgName -StorageAccountName $srcAccountName |
    New-AzStorageContainer $srcContainerName1
Get-AzStorageAccount -ResourceGroupName $rgName -StorageAccountName $destAccountName |
    New-AzStorageContainer $destContainerName1
Get-AzStorageAccount -ResourceGroupName $rgName -StorageAccountName $srcAccountName |
    New-AzStorageContainer $srcContainerName2
Get-AzStorageAccount -ResourceGroupName $rgName -StorageAccountName $destAccountName |
    New-AzStorageContainer $destContainerName2

# Define replication rules for each container.
$rule1 = New-AzStorageObjectReplicationPolicyRule -SourceContainer $srcContainerName1 `
    -DestinationContainer $destContainerName1 `
    -PrefixMatch b
$rule2 = New-AzStorageObjectReplicationPolicyRule -SourceContainer $srcContainerName2 `
    -DestinationContainer $destContainerName2  `
    -MinCreationTime 2021-09-01T00:00:00Z

# Create the replication policy on the destination account.
$destPolicy = Set-AzStorageObjectReplicationPolicy -ResourceGroupName $rgName `
    -StorageAccountName $destAccountName `
    -PolicyId default `
    -SourceAccount $srcAccountName `
    -Rule $rule1,$rule2

# Create the same policy on the source account.
Set-AzStorageObjectReplicationPolicy -ResourceGroupName $rgName `
    -StorageAccountName $srcAccountName `
    -InputObject $destPolicy```

Observed Behavior

New-AzStorageContainer: This request is not authorized to perform this operation.                                       
RequestId:c8e6af7c-101e-0030-21c6-2ed069000000
Time:2023-12-14T19:49:49.7620591Z
Status: 403 (This request is not authorized to perform this operation.)
ErrorCode: AuthorizationFailure

Content:
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.
RequestId:c8e6af7c-101e-0030-21c6-2ed069000000
Time:2023-12-14T19:49:49.7620591Z</Message></Error>

Headers:
Server: Microsoft-HTTPAPI/2.0
x-ms-request-id: c8e6af7c-101e-0030-21c6-2ed069000000
x-ms-client-request-id: c972ad2d-f55a-4fb7-8f74-fc0b88730142
x-ms-error-code: AuthorizationFailure
Date: Thu, 14 Dec 2023 19:49:49 GMT
Content-Length: 246
Content-Type: application/xml

Expected behavior

create a storage container. I ran the same commands in VS code to my subscription and had no issues. But using cloudshell it didnt work.

Is this specific to Cloud Shell?

Yes. Tested the same script in VS code and didnt have this issue.

Interface information

How are you accessing Cloud Shell - https://portal.azure.com,

Additional context

Add any other context about the problem here.

[mbifeld]

Does it work if you run 'az login' in Cloud Shell prior to running the command?

[jileary23]

running 'az-login' wasn't part of the instructions: https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-configure?tabs=powershell#configure-object-replication-with-access-to-both-storage-accounts