As commented you need to assign "Storage Blob Data Contributor or Storage Account Contributor to the service principal you're using in the "connection" provided to the "external location". 

Another more advanced and even better option would be to use the "managed identity" associated to an "Azure Access Connector for Databricks" so that you can avoid usage of secrets or passwords. That "managed identity" should be provided with same roles.

I explain that in this video but it's only in spanish so far. Maybe I'll make it in english soon 🙂 https://youtu.be/HSSWP5UbkNY?si=DdzKx-KGJJQUXb3k