How can a storage account blob be created as a custom error page on an Application Gateway Listener if the customer does not want the blob to be publicly accessible?

Question

I am currently working with a customer that wants to use the Storage Account Blob as a custom error page on a Listener in Application Gateway. The customer does not want the blob publicly accessible. How can listener gain access to the blob?

Answer 1

@Handy, Frederick Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Yes this is a pre-requisite actually as the error page needs to be publicly accessible ( As per the desgin)
https://learn.microsoft.com/en-us/azure/application-gateway/custom-error#requirements.

Already there is Azure feedback on this feature, please upvote the idea, I'll follow up with the Product team on this feature and keep you informed .Please subscribe to Azure Updates to stay updated on the latest feature developments

There is also similar discussion thread which provides some idea on your query: set a custom error page for azure application gateway 403 page

Additonal information:
Azure Application Gateway does not support managed identities for accessing Azure Storage Accounts with authentication; it only supports managed identities for Azure Key Vault.

To access an Azure Storage Account from an Application Gateway's public IP, ensure that your storage is accessible over the public network. It is not possible to access the storage account authorized by using Managed Identity from the Application Gateway. Once I enable public access to the storage account, I will be able to access it from the application gateway.

Please let us know if you have any further queries. I’m happy to assist you further.   

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.