This was solved by adding the 'Reader' role to the service principal in the storage account. (Thanks to a commenter that has deleted his comment, however.)