{"record":{"id":"b0895b9d35d2de85","repo":"home-assistant/core","slug":"invalid-auth-b0895b","errorCode":null,"errorMessage":"invalid_auth","messagePattern":"invalid_auth","errorType":"exception","errorClass":"ConfigEntryAuthFailed","httpStatus":null,"severity":"error","filePath":"homeassistant/components/azure_storage/__init__.py","lineNumber":68,"sourceCode":"            transport=AioHttpTransport(session=session),\n        )\n\n    # has a blocking call to open in cpython\n    container_client: ContainerClient = await hass.async_add_executor_job(\n        create_container_client\n    )\n\n    try:\n        if not await container_client.exists():\n            await container_client.create_container()\n    except ResourceNotFoundError as err:\n        raise ConfigEntryError(\n            translation_domain=DOMAIN,\n            translation_key=\"account_not_found\",\n            translation_placeholders={CONF_ACCOUNT_NAME: entry.data[CONF_ACCOUNT_NAME]},\n        ) from err\n    except ClientAuthenticationError as err:\n        raise ConfigEntryAuthFailed(\n            translation_domain=DOMAIN,\n            translation_key=\"invalid_auth\",\n            translation_placeholders={CONF_ACCOUNT_NAME: entry.data[CONF_ACCOUNT_NAME]},\n        ) from err\n    except AzureError as err:\n        raise ConfigEntryNotReady(\n            translation_domain=DOMAIN,\n            translation_key=\"cannot_connect\",\n            translation_placeholders={CONF_ACCOUNT_NAME: entry.data[CONF_ACCOUNT_NAME]},\n        ) from err\n\n    entry.runtime_data = container_client\n\n    def _async_notify_backup_listeners() -> None:\n        for listener in hass.data.get(DATA_BACKUP_AGENT_LISTENERS, []):\n            listener()\n\n    entry.async_on_unload(entry.async_on_state_change(_async_notify_backup_listeners))","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/components/azure_storage/__init__.py#L50-L86","documentation":"Raised as ConfigEntryAuthFailed (translation key invalid_auth) when the Azure Blob Storage setup call fails with ClientAuthenticationError. It means the request reached the account but authentication was rejected (bad SAS token, expired key, wrong shared key, or insufficient RBAC permissions). HA marks the entry as needing re-authentication and shows a reauth flow instead of retrying.","triggerScenarios":"container_client.exists() raises azure.core.exceptions.ClientAuthenticationError (HTTP 401/403) because the SAS token is expired/malformed or the Entra identity lacks the Storage Blob Data Reader/Contributor role.","commonSituations":"Expired SAS token, regenerated storage keys invalidating the saved connection string, managed identity without RBAC role assignment on the storage account.","solutions":["Open the reauth prompt for the entry and re-enter a valid SAS token / connection string","If using keys, verify against the currently active key in the Azure portal (keys can be rotated)","If using Entra/managed identity, assign 'Storage Blob Data Contributor' to the identity on the account","Check the SAS token's expiry and allowed permissions (read/write/create container) and IP restrictions"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"def is_auth_error(err: BaseException) -> bool:\n    from azure.core.exceptions import ClientAuthenticationError\n    return isinstance(err, ClientAuthenticationError)","tryCatchPattern":"try:\n    await container_client.exists()\nexcept ClientAuthenticationError as err:\n    # start reauth flow; do not retry with the same credentials\n    raise ConfigEntryAuthFailed(...) from err","preventionTips":["Prefer long-lived account keys or managed identity over short-expiry SAS tokens","Test SAS tokens (expiry, permissions, allowed IP) before saving them in the entry","Rotate keys through the reauth flow promptly after regenerating in Azure"],"tags":["azure","blob-storage","auth","config-entry"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}