Azure Front Door with Azure Storage Blobs

Artem Shaturskyi 145

Hello!
We have an Azure Blob Storage account containing a large number of media files (.MP4). These files are manually organized into categorized folders under a single container. Our goal is to allow all corporate users to access the container and watch the media files directly in their browsers - no streaming or additional services, just simple playback.

I initially tried using Static Website Hosting with a pre-generated index.html, but generating SAS tokens for every file is not a feasible solution due to the large number of files.

I decided to implement Azure Front Door for the storage account, and it seems to work for file access, but I can't configure it to require user authentication.
How can I configure Azure Front Door to enforce Microsoft Entra ID authentication for accessing storage resources?

hossein jalilian 9,930 Reputation points

2025-02-06T17:52:03.4633333+00:00
Hello Artem Shaturskyi,

Thanks for posting your question in the Microsoft Q&A forum.

Azure Front Door doesn't natively support Microsoft Entra ID authentication for direct blob access. However, you can achieve this by using a combination of Azure Front Door, Azure Functions, and Azure Storage.

Create an Azure Function App: Develop an HTTP-triggered function that acts as a proxy between Front Door and Blob Storage and implement Microsoft Entra ID authentication in the function.

Configure Azure Front Door: Set up a backend pool pointing to your Azure Function App, then create routing rules to direct traffic to the function.

Implement authentication and authorization: Use Microsoft.Identity.Web library in your Azure Function to handle Microsoft Entra ID authentication, validate user tokens and permissions in the function.

Proxy requests to Blob Storage: Once authenticated, use the Azure Storage SDK in your function to retrieve the requested blob, stream the blob content back to the client through the function response.

Configure CORS: Set up CORS rules on your Storage account to allow requests from your Front Door endpoint.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful
Artem Shaturskyi 145 Reputation points

2025-02-07T07:48:45.76+00:00

Disgusting. A simple and seemingly obvious task requires writing a custom backend. Really? There’s no way to do this without coding, just by using Azure resources?
Udayashankar K.N 235 Reputation points Microsoft Employee

2025-02-10T11:37:25.06+00:00

Considering that Front door configuration being a complex one as an alternate you can even use Private Endpoint + Application Gateway

Use Azure Storage Private Endpoint to block direct internet access.

Deploy an Azure Application Gateway with Microsoft Entra authentication.

Route traffic through Azure Front Door → App Gateway → Storage.
Sai Prasanna Sinde 3,845 Reputation points Microsoft Vendor

2025-02-12T08:07:25.37+00:00

Hi @Artem Shaturskyi

Following up to see if the below answers helped. If you have any further queries, please let us know in the comments below so that we can address them.
Sai Prasanna Sinde 3,845 Reputation points Microsoft Vendor

2025-02-13T08:12:34.44+00:00

Hi @Artem Shaturskyi

Following up to see if the below answers helped. If you have any further queries, please let us know in the comments below so that we can address them.

1 answer

Suwarna S Kale 696 Reputation points

2025-02-10T19:02:52.01+00:00

Hello Artem Shaturskyi,

Thank you for posting your question in the Microsoft Q&A forum.

Using Microsoft Entra ID authentication for direct blob access. Instead, it is designed for internet-facing scenarios and is optimized for publicly accessible blobs. To authenticate blob access you may try SAS (Shared Access Signature) with FrontDoor. Refer Microsoft doc link - https://learn.microsoft.com/en-us/azure/frontdoor/scenario-storage-blobs

For direct blob access with Microsoft Entra ID authentication, you can use Azure Storage, which supports Microsoft Entra ID to authorize requests to blob data. Refer Microsoft doc link - https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory

Please let me know if this helped to resolve the issue on your side. Please remember "Accept Answer" if above reply helped, so that others in the community facing similar issues can easily find the solution.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Front Door with Azure Storage Blobs

1 answer

Your answer