I have this situation:

We have publicly available app service with public internet access and I have blob storage with images. I need to have this app publicly accesible, but blob storage should be private. I’ve tried to implement it via privatelink and enabled vNet integration for App service Outbound traffic configuration with subnet. So, I have this subnet 10.0.3.0/24 for app service. For privatelink I am using another one 10.0.1.0/24. But they are in the same vNet. For storageaccount I also enabled access restrictions to allow access only from my vNet. But when I am using privatelink, I am receiving when connecting from public application net::ERR_NAME_NOT_RESOLVED (from app service machine I can resolve this name). If I am using ServiceAccount without private link, I am receiving Forbidden (after disabling vNet access and making blob public I can access it). I assume that it connects with my Client Public IP instead of vNet ip from app service and only one solution is to whitelist every IP in firewall. So, the question is – what I’ve done wrong and is that possible to implement this architecture? As I moved from AWS and currently this Azure magic is a little bit complicated for me 🙂

Privatelink and App Service are in the same vNet and subscription