• Ensure your service principal has the minimum required Azure RBAC roles (these are not app roles in Azure AD; they are resource-level permissions):
  RoleScopePurpose

  Storage Blob Data Contributor	Storage account	Read/write blobs for file discovery.
  Storage Queue Data Contributor	Storage account	Manage queues for notifications (if not using connection string).
  EventGrid EventSubscription Contributor	Resource group (or subscription)	Create/read/delete Event Grid subscriptions.
  Contributor	Storage account and resource group	General setup (broader; use if custom roles fail).

• Assign these via Azure Portal > Storage Account/Resource Group > Access Control (IAM) > Add role assignment > Select service principal.

Also, remove unnecessary app role assignments (likely root cause)