Azure CDN with storage account private endpoint

Question

We have VAPT findings to add a storage account to private endpoint.

Storage account is used by Azure CDN as origin.

After adding endpoint the Azure CDN cannot access and gives error with an XML page.

How to access storage account with private endpoint from Azure CDN?

Answer 1

You need to give access over the firewall. For Microsoft CDN (classic) that would be the following range 147.243.0.0/16 as found in the Microsoft documentation .

Answer 2

if you've placed your storage account in a private link then i imagine you probably want to protect its content from unwanted access.

i think @travisez13's solution would allow anything running in azure to access the storage account directly, assuming they could guess the names.

i think you may want to try this approach instead: https://docs.microsoft.com/en-us/azure/cdn/cdn-sas-storage-support