Connect Azure Storage account from Azure App service ?

Question

I need to connect App Service with Storage account which allows only from selected virtual networks and IP Address.

1. I have added all outbound IP address of App service to Storage account Firewall.
2. Added storage blob / table contributor roles to app service.
3. tried VNET configuration.

Still not able to access. Anyone faced the similar issues ? Please suggest your insights

Answer 1

Hi Thanks for the question.

To add to the comment above:

This blog describes the options in detail the Az web app to storage account network integration options
https://techcommunity.microsoft.com/t5/apps-on-azure-blog/app-service-to-storage-account-connection-condition-summary/ba-p/2968642

One last thing, once you have the connectivity working , be sure that your storage account is secure:

For example, if you connect the web app over a private endpoint, ensure that public access into the storage account is restricted or "off".

However you configure the networking for connectivity you still need to ensure that the web app is connecting securely using a credential with the minimum privileges. One of the best ways to do this is via AAD auth into the storage account using a Managed Service Identity from the Web App. Other options include using a storage account token.

The following learn tutorial explains this in more detail https://learn.microsoft.com/en-us/azure/app-service/scenario-secure-app-access-storage?tabs=azure-portal

Please mark the answer as accepted if it helps you , as this helps others with the same question.

Answer 2

@Seenivasan S R Thanks for reaching here!

It appears that you want to restrict access to Blob storage so that it can only be accessed from an Azure App Service.

However, there are some limitations with the Blob storage firewall in this scenario when both resources are in the same Azure region and IP network rules have no effect on requests originating from the same Azure region as the storage account. Check Grant access from an internet IP range 

Work around

1. Add IP address when app service and storage are located in a different region- When resources are located in a different region, the IP address firewall setting works.
2. When blob storage uses VNet firewall, app service must be integrated with VNet.  See VNet integration. For this scenario suggest you check limitations for VNet integration
3. Further if you use function app please add WEBSITE_CONTENTOVERVNET = 1 value of 1 enables your function app to scale when you have your storage account restricted to a virtual network. You can see the detail about this setting website_contentovervnet.

For more details: see- this blog post

Let us know if further query or issue remains.