UC Cloud Storage Access Failure (UC_CLOUD_STORAGE_ACCESS_FAILURE)

Even if IAM + ACLs look correct, Unity Catalog will not use ACLs directly. UC always accesses ADLS through a Storage Credential → External Location → Catalog chain.

A few things to verify:

1. Check which identity UC is actually using

Run:

SHOW EXTERNAL LOCATIONS;

DESCRIBE EXTERNAL LOCATION <your_location>;

The credential listed here must map to the Access Connector managed identity, not your user.

If the location shows a different storage credential, UC will try to access ADLS with the wrong identity → AbfsRestOperationException.

1. Confirm that the metastore root is UC-compatible

DESCRIBE CATALOG <your_catalog>;

The storage_location must itself be an external location with a valid credential.

If the metastore root was created before UC, it might not be correctly attached.

1. Check ADLS diagnostic logs

Enable "Blob Read/Write/Error" diagnostics on the storage account.

You will likely see failed requests from a principal different from the Access Connector MI — that’s the real smoking gun.

1. ACLs help, but are not sufficient

Unity Catalog requires:

Access Connector MI → StorageCredential assignment

StorageCredential → External Location

External Location → Catalog/Schema/Table

ACLs alone won’t fix UC initialisation.