(newbie) how to access Azure container files via curl in Linux VM?

John L 0 Reputation points
2026-08-04T17:35:09.5766667+00:00

I've uploaded several files to an Azure storage container and would like to load them into my Linux VM via curl.

I've created a Private Endpoint for the container.

I've tried to access the files via the VM private IP, the Private Endpoint IP, and the 127.0.0.1 loop back IP.

The nsg outbound rules allow these connections .

curl fails with "connection refused.", or in the case of the Private Endpoint "no route to host"

Thanks in advance for any insight you can provide.

Azure Blob Storage
Azure Blob Storage

An Azure service that stores unstructured data in the cloud as blobs.

0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-08-04T17:35:27.4733333+00:00

    For Azure Blob Storage behind a private endpoint, curl should target the storage account blob FQDN, not the VM private IP, not the private endpoint IP directly, and not 127.0.0.1.

    Use this pattern from the Linux VM:

    curl https://<STORAGE ACCOUNT>.blob.core.windows.net/<CONTAINER NAME>/<FILE NAME>

    If the blob is accessed with Microsoft Entra authentication, first get an access token from the VM’s managed identity, then pass it as a bearer token:

    curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fstorage.azure.com%2F' -H Metadata:true

    Then call the blob:

    curl https://<STORAGE ACCOUNT>.blob.core.windows.net/<CONTAINER NAME>/<FILE NAME> -H "x-ms-version: 2017-11-09" -H "Authorization: Bearer <ACCESS TOKEN>"

    For the private endpoint path to work, DNS must resolve the storage account name to the private endpoint IP. The most important check is DNS resolution.

    From the VM, verify the name resolves privately. A correct result includes *.privatelink.* and a private IP such as 10.x.x.x or 172.16.x.x. If the name resolves to a public IP, the VM is not using the private DNS path.

    Typical interpretation:

    • *.privatelink.* + private IP: DNS is correct.
    • Public IP and no *.privatelink.*: private DNS zone is missing or not configured.
    • NXDOMAIN or server can’t find the name: DNS zone or forwarder is misconfigured.

    If DNS is correct but curl still shows no route to host or timeouts, the next likely causes are:

    1. NSG or firewall rules blocking traffic between the VM subnet and the private endpoint subnet.
    2. Missing or disconnected VNet peering if the VM and private endpoint are in different VNets.
    3. Routing issues causing traffic not to reach the private endpoint.

    If the VM is outside the VNet that is linked to the private DNS zone, DNS requests must be forwarded to Azure-side DNS so the storage account FQDN resolves to the private endpoint IP.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Megha Ramakrishnan 500 Reputation points
    2026-08-09T07:14:05.03+00:00

    Hi @John L

    Welcome to Microsoft Q&A.
    When using a Private Endpoint for Azure Storage, you cannot access the container directly via the VM’s private IP, the Private Endpoint IP, or 127.0.0.1. Azure Storage requires requests to be made against the storage account’s endpoint (FQDN), and the Private Endpoint ensures that traffic to that FQDN is routed privately within your VNet.

    Why your attempts failed:

    1. VM private IP / loopback (127.0.0.1): These addresses only resolve to the VM itself, not the storage service.
    2. Private Endpoint IP: This IP is not meant to be accessed directly. It is bound to the storage account’s DNS name, and Azure automatically maps that name to the Private Endpoint IP via private DNS.
    3. Connection refused/No route to host: These errors occur because the request bypasses DNS and does not reach the storage service correctly.

    Correct way to access files:

    1. Ensure you have a Private DNS Zone linked to your VNet for privatelink.blob.core.windows.net. 
        This allows the storage account FQDN (e.g., mystorageaccount.blob.core.windows.net) to resolve to the Private Endpoint IP.
    2. From your Linux VM, use curl with the storage account’s blob endpoint:
    curl -H "Authorization: Bearer <token>" \
     https://mystorageaccount.blob.core.windows.net/mycontainer/myfile.txt

    Replace <token> with a valid SAS token or OAuth token.

    1. Verify NSG rules allow outbound traffic to the Private Endpoint subnet.
    2. Test DNS resolution:
    nslookup mystorageaccount.blob.core.windows.net

    It should resolve to the Private Endpoint IP.

    Please upvote and accept the answer if it helps!!

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.