Custom Vision Publish Error: AuthorizationFailed on Storage Encryption Scopes (No Access to iris-UKSouth-prod-data Storage Account)

Hi everyone,

I'm having a really frustrating issue trying to publish my Custom Vision model, and no matter what I try, it keeps failing with the same authorization error.

**The exact error:

"error":{"code":"AuthorizationFailed","message":"The client '' with object id '' does not have authorization to perform action 'Microsoft.Storage/storageAccounts/encryptionScopes/read' over scope '/subscriptions/*/resourceGroups/iris-UKSouth-prod-data/providers/Microsoft.Storage/storageAccounts/irisprodukspredictions/encryptionScopes/' or the scope is invalid."

What I’m trying to do

• I’ve built a Custom Vision logo detection.
• When I hit Publish, I select my prediction resource.

Publishing fails every single time with the AuthorizationFailed message above.

What makes this weird

I cannot see the storage account mentioned in the error (irisprodukspredictions inside RG iris-UKSouth-prod-data) anywhere in my subscription.

I have Contributor access to my own subscription, but apparently Custom Vision is trying to reach into a storage account that I don’t have permission to view or read encryption scopes for.

When I go to Storage Accounts in the portal, there are zero accounts showing under my subscription.

It feels like my Custom Vision resources were deployed into, or connected to, someone else’s subscription, and now I don’t have the RBAC rights to complete the publish step.

What I’ve already tried

Verified region alignment (all in UK South).

Checked IAM on the prediction resource.

Re-created prediction/training resources.

Tried publishing under a different project.

Tried using the “Create a support request” option in Azure Portal — which keeps looping me into the Troubleshooter rather than the actual support ticket form (a separate issue in itself…).

My question

Why is Custom Vision trying to read encryption scopes on a storage account I can’t access, and how do I grant myself (or Custom Vision) the correct RBAC permissions?

I suspect the solution is something like:

I need “Storage Account Contributor” (or similar) on the storage account used by the prediction resource BUT I can’t find the account or resource group in the portal.

So either:

The storage account is in a different subscription under my tenant or

My Custom Vision resource automatically created it somewhere I don’t have permissions to see or

Something is misconfigured about the underlying storage link between Custom Vision and Azure Storage.

Any help pointing me to the right fix would be hugely appreciated — this is blocking me from deploying my model, and I’m hitting a wall.

Thanks!

What I’m trying to do

I’ve built a Custom Vision image classifier in the portal.

When I hit Publish, I select my prediction resource (PlatformationLogoDetection-Prediction).

Publishing fails every single time with the AuthorizationFailed message above.

What makes this weird

I cannot see the storage account mentioned in the error (irisprodukspredictions inside RG iris-UKSouth-prod-data) anywhere in my subscription.

I have Contributor access to my own subscription, but apparently Custom Vision is trying to reach into a storage account that I don’t have permission to view or read encryption scopes for.

When I go to Storage Accounts in the portal, there are zero accounts showing under my subscription.

It feels like my Custom Vision resources were deployed into, or connected to, someone else’s subscription, and now I don’t have the RBAC rights to complete the publish step.

What I’ve already tried

Verified region alignment (all in UK South).

Checked IAM on the prediction resource.

Re-created prediction/training resources.

Tried publishing under a different project.

Tried using the “Create a support request” option in Azure Portal — which keeps looping me into the Troubleshooter rather than the actual support ticket form (a separate issue in itself…).

My question

Why is Custom Vision trying to read encryption scopes on a storage account I can’t access, and how do I grant myself (or Custom Vision) the correct RBAC permissions?

I suspect the solution is something like:

I need “Storage Account Contributor” (or similar) on the storage account used by the prediction resource
BUT I can’t find the account or resource group in the portal.

So either:

The storage account is in a different subscription under my tenant
or

My Custom Vision resource automatically created it somewhere I don’t have permissions to see
or

Something is misconfigured about the underlying storage link between Custom Vision and Azure Storage.

Any help pointing me to the right fix would be hugely appreciated — this is blocking me from deploying my model, and I’m hitting a wall.

Thanks!

P.S. I used a bit of ChatGPT to try and explain the issue best, I hope it helps. Essentially, when I hit publish for my custom vision model, it errors inexplicably, and I've explored a few options but nothing is working. Note: PII removed at support side