Azure Media Service Submit JobInputHttp from a private blob storage container

Question

I want to submit a JobInputHttp from a private azure blob storage container but I keep getting an access denied error when Media Services tries to download the file.

My Azure Media Service account has a User Manage Identity which I have also assigned to the private blob storage account.

The whole thing works properly when I add a SAS key to the private blob storage URL when submitting the Job but I would like to avoid doing that.

Is this supposed to work or do I always need to pass a SAS key in the JobInputHttp Url?

Answer 1

This behavior is by design. The JobInputHttp is not 'aware' of Azure Storage as a special type of HTTP server. The JobInputHttp is meant to work with any web server, therefore the HTTP URL must be public.

Answer 2

Can you also please verify if the storage account is associated with managed identity in the “storage accounts” menu(in media services extension).