Receiving the following error translating documents. "InvalidDocumentAccessLevel"

InvalidDocumentAccessLevel for document translation with Azure Translator in Foundry Tools almost always indicates a storage access or request-format issue for batch document translation, even if text translation works.

For a managed identity / RBAC-based setup, verify the following points end to end:

1. Confirm the HTTP request format

• For batch document translation, the request must be sent to:
  • https://<NAME-OF-YOUR-RESOURCE>.cognitiveservices.azure.com/translator/text/batch/v1.1/batches
• Required headers:
  • Ocp-Apim-Subscription-Key: key for the Translator or Foundry resource
  • Content-Type: application/json or charset=UTF-8
• Request body must be a JSON object named inputs with sourceUrl and targetUrl container addresses, for example:

    {
        "inputs": [
            {
                "source": {
                    "sourceUrl": "https://<storage_account>.blob.core.windows.net/<source-container>"
                },
                "targets": [
                    {
                        "targetUrl": "https://<storage_account>.blob.core.windows.net/<target-container>",
                        "language": "fr"
                    }
                ]
            }
        ]
    }
  

• With managed identity, do not include SAS tokens in sourceUrl or targetUrl. Including a SAS token causes requests to fail.

2. Validate managed identity and RBAC on the storage account

• Ensure the Translator resource’s managed identity is enabled and has access to the storage account.
• On the storage account, assign appropriate roles (for example, Storage Blob Data Contributor) to the Translator resource’s managed identity at the account or container level.
• After assigning or changing role assignments, allow up to 30 minutes for Azure RBAC changes to propagate, then retry and refresh.

3. Check for destination file name conflicts

• If a file with the same name already exists in the destination container, the job fails.
• Ensure the target container does not already contain blobs with the same names as the translated outputs.

4. Confirm container URLs and filters

• sourceUrl and targetUrl must be valid container URLs in the form:
  • https://<storage_account_name>.blob.core.windows.net/<container_name>
• If using prefix or suffix filters, verify they correctly match the blobs intended for translation.
• Ensure the targetUrl for each target language is unique.

5. Check job and document status for more detail

• If translated files do not appear in the target container, query:
  • Job status: Get status for a specific translation job
  • Document status: Get status for a specific document
• These status calls can provide more specific error details per document.

6. Validate document formats

• If some documents are unsupported, the job can fail. Confirm the file types using “Get supported document formats” and ensure only supported formats (such as .docx, .pptx, .pdf, .md, etc.) are in the source container.

If all of the above are correct—especially the plain container URLs without SAS, correct inputs JSON shape, and RBAC fully propagated—the InvalidDocumentAccessLevel error should be resolved and documents should appear in the target container after a successful 202 Accepted batch request.

References:

• Managed identities: role-based access control (RBAC)
• Use Document Translation APIs programmatically
• What is Azure Translator document translation in Foundry Tools?