Edit

Connect Azure Front Door Premium to a storage static website with Private Link

  • Article

This article guides you through how to configure Azure Front Door Premium tier to connect to your storage static website privately using the Azure Private Link service.

Prerequisites

In this section, you map the Private Link service to a private endpoint created in Azure Front Door's private network.

  1. Sign in to the Azure portal.

  2. Within your Azure Front Door Premium profile, under Settings, select Origin groups.

  3. Select the origin group that contains the storage static website origin you want to enable Private Link for.

  4. Select + Add an origin to add a new storage static website origin or select a previously created storage static website origin from the list.

    Screenshot of enabling private link to a storage static website primary.

  5. The following table has the information of what values to select in the respective fields while enabling private link with Azure Front Door. Select or enter the following settings to configure the storage static website you want Azure Front Door Premium to connect with privately.

    Setting Value
    Name Enter a name to identify this storage static website origin.
    Origin Type Storage (Static website)
    Host name Select the host from the dropdown that you want as an origin.
    Origin host header You can customize the host header of the origin or leave it as default.
    HTTP port 80 (default)
    HTTPS port 443 (default)
    Priority Different origin can have different priorities to provide primary, secondary, and backup origins.
    Weight 1000 (default). Assign weights to your different origin when you want to distribute traffic.
    Region Select the region that is the same or closest to your origin.
    Target sub resource The type of subresource for the resource selected previously that your private endpoint can access. You can select web or web_secondary.
    Request message Custom message to see while approving the Private Endpoint.

  6. Then select Add to save your configuration. Then select Update to save your changes.

Approve private endpoint connection from storage account

  1. Go to the storage account that you want to connect to Azure Front Door Premium privately. Select Networking under Settings.

  2. In Networking, select Private endpoint connections.

    Screenshot of private endpoint connection tab under storage account networking settings.

  3. Select the pending private endpoint request from Azure Front Door Premium then select Approve.

    Screenshot of approving private endpoint connection from storage account.

  4. Once approved, you can see the private endpoint connection status is Approved.

    Screenshot of approved private endpoint connection from storage account.

Create private endpoint connection to web_secondary

When creating a private endpoint connection to the storage static website's secondary sub resource, you need to add a -secondary suffix to the origin host header. For example, if your origin host header is contoso.z13.web.core.windows.net, you need to change it to contoso-secondary.z13.web.core.windows.net.

Screenshot of enabling private link to a storage static website secondary.

Once the origin is added and the private endpoint connection is approved, you can test your private link connection to your storage static website.

Next steps

Learn about Private Link service with storage account.