I understand that this is old and OP probably doesn't need it anymore, but for anyone else searching and coming across this post:

For blob trigger, you'd need "Storage Account Contributor" on whatever storage account you are running your queue service on.

https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-storage-blob-trigger?tabs=python-v2%2Cisolated-process%2Cnodejs-v4%2Cextensionv5&pivots=programming-language-csharp#grant-permission-to-the-identity

The reason for this is that when it is initializing, it called properties on the storage account. That call requires storage account contributor:

https://learn.microsoft.com/en-us/rest/api/storageservices/set-blob-service-properties?tabs=microsoft-entra-id#authorization