I guess that when you run it locally it's running as your actual personal user, not as the service principal from your pipeline - and that you personally have the 'Contributor' or 'Owner' permissions on that resource group. I manually set all the ARM_ env. vars. locally to reference the details of the pipeline's SP so I can test locally.

@rhythmic-vegetable-87369 I think @better-rainbow-14549 might be right. The client ID of the service principal is there in the error message:

21b1f2bf-4c53-4095-9ce2-4af53127ba02

You can start by checking if this matches the service principal you think should be used by your pipeline, and if yes, check that it has the necessary role assignments on the storage account (or higher) to create additional role assignments.

Thanks, I'm looking into that.

yes, your pipeline runs in a different context than your local which most likely uses your authenticated user session