I have an app which connects to a Storage account by using a DefaultAzureCredentials. It is working fine. However if I change the Blob storage account to a secondary:

"https://{0}-secondary.blob.core.windows.net"

it returns 403… What is wrong? The storage is configured as RA-GRS.

var blobServiceClient = new BlobServiceClient(secondaryStorageUri, GetCredentials(secondaryStorageUri));
var containerClient = blobServiceClient.GetBlobContainerClient(containerName)
var blobClient = containerClient.GetBlobClient(blobName);
await blobClient.ExistsAsync(cancellationToken);

The error:

Service request failed.
Status: 403 (This request is not authorized to perform this operation.)
ErrorCode: AuthorizationFailure

Headers:
Transfer-Encoding: chunked
Server: Microsoft-HTTPAPI/2.0
x-ms-request-id: 2044953f-001e-0065-4ae3-9a3ba0000000
x-ms-client-request-id: 6af74fdb-bdf4-44c8-9052-ef8549174b43
x-ms-error-code: AuthorizationFailure
Date: Tue, 30 Apr 2024 09:46:59 GMT

at Azure.Core.HttpPipelineExtensions.<ProcessMessageAsync>d__0.MoveNext()
   at Azure.Storage.Blobs.BlobRestClient.<GetPropertiesAsync>d__14.MoveNext()
   at Azure.Storage.Blobs.Specialized.BlobBaseClient.<GetPropertiesInternal>d__124.MoveNext()
   at Azure.Storage.Blobs.Specialized.BlobBaseClient.<ExistsInternal>d__118.MoveNext()
   at Azure.Storage.Blobs.Specialized.BlobBaseClient.<ExistsAsync>d__117.MoveNext()

Without the -secondary in the URL the same code works…