Enabled System ID in AFD to access blob containers - no access

Question

Enabled System ID in AFD to access blob containers - no access

Matthew Barrett 176

I followed the instructions https://learn.microsoft.com/en-us/azure/frontdoor/origin-authentication-with-managed-identities and configured based on anonymous access. I am unable to access the blobs now even with anonymous access still enabled.

I have AFD Standard and a storage account in the same resource group and I want Internet traffic to be allowed only via AFD interface. Currently, anonymous blobs are accessible via the blob URI (i.e. https://media.blob.core.windows.net).

Thanmayi Godithi 11,905 Reputation points Microsoft External Staff Moderator

2026-04-10T15:53:02.5966667+00:00

Hi Matthew Barrett ,

Thank you for reaching out on Microsoft Q&A forum.

We will look into your issue and will get back to you shortly. Meanwhile could you please provide the details requested over Private message.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-04-10T16:42:21.35+00:00

Hi @ Matthew Barrett,

Thank you for reaching out on Microsoft Q&A forum.

If you are using a storage account with public anonymous access enabled, follow the below steps in the exact sequence - 'Associating the identity to an origin group' followed by 'Providing access at the origin resource'. Once all steps are complete, you can disable public anonymous access to only allow access to your storage account from Front Door.

If you are using a storage account with public anonymous access disabled, you have to follow a different sequence. First do the steps for 'Providing access at the origin resource' followed by 'Associating the identity to an origin group'. Start sending traffic via Front Door to the storage account only after completing all the steps in the aforementioned sequence.

Follow the Associating the identity to an origin group

Could you please share the health probe logs via private message, along with the error screenshot and your email ID for the Teams call?

Hope you assigned required RBAC role to AFD System Managed Identity.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Matthew Barrett 176 Reputation points

2026-04-10T17:42:44.3766667+00:00

Your method is the opposite suggested by "Follow the Associating the identity to an origin group". The linked document 'Associating the identity to an origin group' followed by 'Providing access at the origin resource'.
Matthew Barrett 176 Reputation points

2026-04-13T19:59:45.65+00:00

After a couple of days I find there is no security for Storage Accounts unless you pay Microsoft $$$$ for Premium.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-04-13T20:05:26.9666667+00:00
Hi @ Matthew Barrett,

As of now, the Private Link feature is supported only in the Premium tier of Azure Front Door.refer link For securing the storage account, there are multiple options available:

Use Private Endpoints for secure access within a virtual network

Configure Network Security (NSP) to allow access only from specific IP addresses or service tags.

Answer accepted by question author

Vallepu Venkateswarlu 10,595 Microsoft External Staff Moderator

Hi @ Matthew Barrett,

As discussed offline, IF you want to access Storage account Privately from AFD Endpoint without premium SKU, it wont work as Private link support only Premium SKU's in Azure Front door, Refer these link.

If you want to restrict access to only Azure Front Door (AFD) and selected virtual networks, disable public access on the storage account. Then configure a private endpoint within the VNet and enable Private Link for AFD.

It will create two private endpoints for access from the VNet and one private endpoint for access from the AFD side only.

Only Option to access from AFD is storage should be in Public access.

Please ensure that the Storage Blob Data Contributor or Storage Blob Data Reader role has been assigned to the AFD system identity and confirm.

I have configured Azure Front Door with a Storage Blob as the origin to access it via the AFD endpoint. The storage account has been created with public access enabled, along with Microsoft Entra authorization and blob anonymous access enabled, as shown below, to allow public access

User's image

Note: Anonymous access is not recommended for production environments due to security concerns. Kindly disable anonymous access and enable private access.

Once these changes are applied, please configure the container authentication method to use Microsoft Entra ID for secure access via the AFD endpoint.
User's image

Please verify that origin authentication is enabled and set to System Managed Identity. Also, ensure that the Storage Blob Data Contributor role is assigned to the AFD identity. Additionally, confirm that the origin protocol is configured to use HTTPS.

User's image

AFD route Configuration, Make sure Pattern to Match should be /* (to access all request)

User's image

After completing all configurations, please wait for 10 minutes for the changes to propagate, and then verify the result.

Please find my AFD result below.

User's image

If above steps are nor resolve your issue, Please share the requested details in Private message for further connectivity.

Pleaseand “up-vote” wherever the information provided helps you, this can be beneficial to other community members

0 comments

1 additional answer

Your answer

Thanmayi Godithi 11,905 Reputation points Microsoft External Staff Moderator

2026-04-10T15:53:02.5966667+00:00

Hi Matthew Barrett ,

Thank you for reaching out on Microsoft Q&A forum.

We will look into your issue and will get back to you shortly. Meanwhile could you please provide the details requested over Private message.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-04-10T16:42:21.35+00:00

Hi @ Matthew Barrett,

Thank you for reaching out on Microsoft Q&A forum.

If you are using a storage account with public anonymous access enabled, follow the below steps in the exact sequence - 'Associating the identity to an origin group' followed by 'Providing access at the origin resource'. Once all steps are complete, you can disable public anonymous access to only allow access to your storage account from Front Door.

If you are using a storage account with public anonymous access disabled, you have to follow a different sequence. First do the steps for 'Providing access at the origin resource' followed by 'Associating the identity to an origin group'. Start sending traffic via Front Door to the storage account only after completing all the steps in the aforementioned sequence.

Follow the Associating the identity to an origin group

Could you please share the health probe logs via private message, along with the error screenshot and your email ID for the Teams call?

Hope you assigned required RBAC role to AFD System Managed Identity.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Matthew Barrett 176 Reputation points

2026-04-10T17:42:44.3766667+00:00

Your method is the opposite suggested by "Follow the Associating the identity to an origin group". The linked document 'Associating the identity to an origin group' followed by 'Providing access at the origin resource'.
Matthew Barrett 176 Reputation points

2026-04-13T19:59:45.65+00:00

After a couple of days I find there is no security for Storage Accounts unless you pay Microsoft $$$$ for Premium.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-04-13T20:05:26.9666667+00:00

Hi @ Matthew Barrett,

As of now, the Private Link feature is supported only in the Premium tier of Azure Front Door.refer link For securing the storage account, there are multiple options available:

Use Private Endpoints for secure access within a virtual network

Configure Network Security (NSP) to allow access only from specific IP addresses or service tags.

Answer 1

Matthew Barrett 176

The storage account provides docs and images for an anonymous website and access must be set to anonymous as we cannot afford to use AFD Premium for the configuration you've provided.

Thanks anyways.

0 comments