Azure DevOps 管道无法复制到 Azure 存储

Question

我有一个管道，可以构建 Web 工件并尝试使用 Azure Pipelines 中提供的 Azure 文件复制任务将它们复制到我的 Azure 存储。过去 2 天我一直在尝试修复此 403 响应，指出存在权限错误。

• 我有此管道的服务连接。
• 服务连接应用程序注册在 API 权限中具有 Azure 存储的 user_impersonation
• 服务连接应用程序注册具有目标存储帐户、资源组和订阅的“存储 Blob 数据贡献者”和“存储 Blob 数据所有者”。

Answer 1

由于存储帐户使用防火墙并根据 your comment 启用了 IP 范围白名单，因此您应该将代理的 IP 地址添加到白名单中。

• 如果您运行自己的构建代理，则非常简单。
• 如果您使用 Microsoft 托管的代理来运行作业，并且需要有关所使用的 IP 地址的信息，请参阅 Microsoft-hosted agents Agent IP ranges。

In some setups, you may need to know the range of IP addresses where agents are deployed. For instance, if you need to grant the hosted agents access through a firewall, you may wish to restrict that access by IP address. Because Azure DevOps uses the Azure global network, IP ranges vary over time. We publish a weekly JSON file listing IP ranges for Azure datacenters, broken out by region. This file is published every Wednesday with new planned IP ranges. The new IP ranges become effective the following Monday. We recommend that you check back frequently to ensure you keep an up-to-date list.

Since there is no API in the Azure Management Libraries for .NET to list the regions for a geography, you must list them manually.

编辑:
这里有一个已关闭(!-但仍然有效)的 GitHub 问题:AzureDevops don't considerate as 'Microsoft Services'

编辑2:

Your hosted agents run in the same Azure geography as your organization. Each geography contains one or more regions. While your agent may run in the same region as your organization, it is not guaranteed to do so. To obtain the complete list of possible IP ranges for your agent, you must use the IP ranges from all of the regions that are contained in your geography. For example, if your organization is located in the United States geography, you must use the IP ranges for all of the regions in that geography.

To determine your geography, navigate to https://dev.azure.com/<your_organization>/_settings/organizationOverview, get your region, and find the associated geography from the Azure geography table. Once you have identified your geography, use the IP ranges from the weekly file for all regions in that geography.