Function App does not work after switching the network to private endpoint on the storage account

Question

Hi,

I created a new functions app and disabled the public network access on the storage account configured for it. The app stopped working as a result. Enabling public access makes the functions app usable, but out security policy does not allow public access on any of the azure resources.

I did create a private end point for the storage account and assigned it as i did on all other storage accounts, does function app require public access on the storage account ?

thanks

Answer 1

When you disable public network access on the storage account and switch to using a private endpoint, the Azure Function App should still be able to access the storage account as long as it is properly configured to use the private endpoint. Here are some key points to consider:

1. Private Endpoint Configuration: Ensure that the private endpoint for the storage account is correctly created and associated with the virtual network that your Function App is integrated with. The Function App must be able to resolve the private endpoint's DNS name.
2. Network Integration: Verify that your Function App is integrated with the same virtual network where the private endpoint is located. If the Function App is not in the same virtual network or does not have access to it, it will not be able to connect to the storage account.
3. DNS Configuration: If you are using a custom DNS server, make sure it is configured to resolve the private endpoint correctly. This is crucial for the Function App to communicate with the storage account.
4. Firewall and Network Rules: Check the firewall settings and network rules on the storage account to ensure that they allow traffic from the virtual network where the Function App is deployed.

If all these configurations are correct and the Function App still does not work, you may want to review the logs for any specific error messages that could provide further insights into the connectivity issues.

---

References:

• How to use a secured storage account with Azure Functions
• Tutorial: Integrate Azure Functions with an Azure virtual network by using private endpoints

Answer 2

Hi nettech,

Thanks for reaching out to Microsoft Q&A.

does function app require public access on the storage account ?

No, it does not require public access on the storage account, but you do need proper networking and configuration to ensure private connectivity.

If you disable public access in the storage account, only selected IP ranges based on firewall rules or private endpoints configured can access the storage account. This leads to 403 error in Azure Function if it was not authorized to access the storage account.

You can secure a new storage account via private endpoint as described in doc: Restrict your storage account to a virtual network and Secure storage account linked to Function App with private endpoint ,this feature is not supported in Consumption plans.

Supported Plans & Networking Requirements:

Azure Functions plans have differing support for secure storage:

Plan	VNet Integration	Supports Secured Storage
Consumption	No	Cannot use secured/private storage
Flex Consumption, Premium, Dedicated/App Service	Yes	Supports private endpoint + private storage

To lock down your storage account while keeping the function app functional, you must use Flex Consumption or Premium/Dedicated plans, paired with VNet integration and a private endpoint on the storage account.

Even after wiring up the private endpoint, the Function App must be explicitly configured to route all storage traffic privately.

This requires adding two Application Settings:

WEBSITE_CONTENTOVERVNET = 1
WEBSITE_VNET_ROUTE_ALL = 1

Without these, the Function runtime may still attempt public endpoint access, which will fail if public network access is disabled. Hope this helps!

---

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.