AzureFileCopy@4 does not work, but AzureFileCopy@3 does when copying files to blog storage

Question, Bug, or Feature? Type: Bug

Enter Task Name: AzureFileCopy@4

Environment

Server - Azure Pipelines

Agent - Hosted: Windows 2017

Issue Description

This is my yaml definition:

- task: AzureFileCopy@4
  displayName: 'Copy ARM Templates to Azure Storage'
  inputs:
    SourcePath: ArmTemplateTestProject/ArmTemplateTestProject
    azureSubscription: 'my connection to Azure Portal'
    Destination: AzureBlob
    storage: mydatastorage
    ContainerName: armtemplate

Task logs

Uploading files from source path: ‘d:\a\1\s\ArmTemplateTestProject\ArmTemplateTestProject\azuredeploy.json’ to storage account: ‘mydatastorage’ in container: ‘armtemplate’ with blob prefix: ‘’ & “AzCopy\AzCopy.exe” copy “d:\a\1\s\ArmTemplateTestProject\ArmTemplateTestProject\azuredeploy.json” “https://mydatastorage.blob.core.windows.net/armtemplate” Error: wrong number of arguments, please refer to the help page on usage of this command

Troubleshooting

Version 3 of the task, with the same settings appears to work. I can’t see anything wrong with the arguments, it appears from the logs to be using the same azcopy command

[jdthorpe]

Seems weird that (A) AzCopy v10 (and hence AzureFileCopy@4) enforces permissions differently than the underlying blob storage data plane, and (B) that granting permissions via the “this pipeline needs permissions to run” popup when running the Azure Pipeline grants sufficient permissions for AzureFileCopy@3 task but not the AzureFileCopy@4 task.

For those unfortunate enough to be as confused about this as I was, the solution is to:

• open the Devops pipeline and note the name of the service connection
• open the project settings at the bottom of the Project page, click “Service Connections”, select the service connection, and then click “Manage Service Principal” and then get the display name (optionally changing it to something unique – as all the service principals for service connections in a project have the same default name which can be confusing for the next step)
• open the Storage resource (Account or container) in the azure portal, then select “Access Control (IAM)” in the blade on the left, then click “Add a role assignment” add the “Storage Blob Data Contributor” role to the service principal

[samsmithnz]

Thank you @20shivangi. One last thought: Should any of this be in the v4 task docs? I don’t see anything, but it’s a change.