title: Firewall access from Azure app service to blob storage using Virtual Network
body: <p>Originally I tried to restrict access from an app service to blob storage using IP addresses, however it turned out that you can only do this using a Virtual Network: <a href="https://stackoverflow.com/questions/55968545/firewall-access-from-azure-app-service-to-blob-storage/55974236#55974236">Firewall access from Azure app service to blob storage</a></p>
  
  <p>I want to be able to achieve this without setting up a point-to-site VPN. The steps I have taken to set up a virtual network in Azure are as follows:</p>
  
  <ul>
  <li>Created Network security group "securitygroup-frontend", add custom
  inbound rule called Web with Source: Service Tag, Source service tag:
  Internet, Source port ranges: *, Destination : Any, Destination port
  ranges: 80, 443, Protocol: Any, Action: Allow, Priority: 100 </li>
  <li>Created Virtual Network with address space 192.168.0.0/23 and subnet called frontend address range 192.168.0.0/26 with network security group: securitygroup-frontend and subnet delegation to Microsoft.Web/serverFarms and service endpoints Microsoft.Storage </li>
  <li>Went to app service -> Networking -> Configure VNet integration ->
  Add VNet preview and select the subnet you created </li>
  <li>Went to Storage -> Firewalls and virtual Networking -> Configure VNet integration -> Select 'Selected networks' and add in the virtual network and subnet just created.</li>
  </ul>
  
  <p>I have had to move Azure diagnostics and logs such as for key vault, service bus and sql azure to its own blob storage as these require  blob storage outside of a virtual network and can't be made to work inside. The app service is in the Standard plan. The app service, blob storage and virtual network are all in the same region.</p>
  
  <p>This question and answer does not provide any insights: <a href="https://social.msdn.microsoft.com/Forums/azure/en-US/9f4d8aeb-68a6-4ec1-9e11-bee2d1301792/allow-access-to-azure-storage-account-only-from-an-app-service?forum=windowsazurewebsitespreview" rel="nofollow noreferrer">https://social.msdn.microsoft.com/Forums/azure/en-US/9f4d8aeb-68a6-4ec1-9e11-bee2d1301792/allow-access-to-azure-storage-account-only-from-an-app-service?forum=windowsazurewebsitespreview</a></p>
  
  <p>The above steps though block off access from the app service to blob storage and any assets within return an error: (403) Forbidden. If I remove the Virtual network from blob storage it works fine. What am I doing wrong?</p>