Hello Ruben Verschueren
You've correctly identified CORS as the central issue affecting your Azure Workbooks' ability to call a custom endpoint.
Even if the origin is allowed, failure to set correct Access-Control-Allow-Headers
, Access-Control-Allow-Methods
, and Access-Control-Allow-Credentials
will cause silent failures in Workbooks.
Function App: Use the following CORS settings in your Azure Function App:
- Allowed Origins:
https://portal.azure.com
(avoid wildcard subdomain if credentials are used) - Credentials Enabled done
- Allowed Headers:
Content-Type, Authorization, x-ms-client-request-id, x-ms-user-agent
- Allowed Methods:
GET
,POST
, etc. depending on your scenario
Refer:
You've already noted this, but to emphasize: Azure Function Apps and APIM must use an exact match for the Azure portal origin — https://portal.azure.com
. Using https://*.portal.azure.com
will be rejected if Access-Control-Allow-Credentials
is true, per the CORS specification.
Refer:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#credentialed_requests_and_wildcards
If you’re using multiple APIs behind your APIM instance, define the CORS policy at the All APIs
scope to avoid missing origins on individual APIs.
<inbound>
<base />
<cors allow-credentials="true">
<allowed-origins>
<origin>https://portal.azure.com</origin>
</allowed-origins>
<allowed-methods>
<method>GET</method>
<method>POST</method>
</allowed-methods>
<allowed-headers>
<header>*</header>
</allowed-headers>
</cors>
</inbound>
Refer:
Let us know if further assistance is needed. Thank you for your understanding and for taking proactive steps to learn responsibly on Azure.
We remind you to close the discussion thread by clicking on "Accept the answer" if the information provided was helpful, as this could also benefit other community members.