Every command needs a scope
Azure has no default location. Each level of the hierarchy is something you point at, by name.
TENANT
HackYourFuture, the organization
az login --tenant 07a1…
SUBSCRIPTION
what gets billed, and who may act
az account show
RESOURCE GROUP
rg-hyf-students, created by your teacher
--resource-group rg-hyf-students
targetScope = 'resourceGroup'
RESOURCE
your storage account
resource storage '…' = { }
NESTED CHILD
the blob container inside it
parent: storage
Each level is named relative to the one above it. Nothing is implicit.
Your deploy is anchored at the red level: the group exists already, everything inside it is yours to declare.
Three errors this explains, before you blame the template
• SubscriptionNotFound · you are signed in at tenant level with no subscription picked
• AuthorizationFailed · right subscription, but your role does not reach that scope
• cannot create the resource group · your role starts one level down, inside it
Diagnose the first two with az account show. If id equals tenantId, no subscription is selected.