My website images, hosted on Azure Blob Storage, are not displaying

Hello Jamal AbdelRahim

Azure Front Door does not modify paths by default. Whatever path the client sends must map 1:1 to a valid blob path.

This behavior is explicitly defined in Front Door routing and Blob origin documentation.

In Azure Front Door Standard/Premium, each endpoint automatically includes a default-route with the /* pattern bound to the *.azurefd.net domain, and any attempt to create another /* route or attach a custom domain to a new overlapping route is rejected with a Conflict with default-route error because Front Door does not allow multiple routes with the same domain and path scope.

Workaround: Reusing and modifying the existing default-route instead of creating a new one, and correcting the origin path so Blob Storage receives a valid container‑prefixed request, prevents route conflicts, eliminates Blob Storage 404 errors, and avoids unsupported routing patterns.

Meantime,

Verify the right origin host & path

• If you’re using a public blob container (not the static-website feature), your origin host should be <youraccount>.blob.core.windows.net and Origin Path empty.
• If you’ve enabled the static website feature, switch your origin host to <youraccount>.zXX.web.core.windows.net and set Origin Path to /$web (no container name in the URL).

1. Resolve the routing-pattern conflict
   • Front Door won’t let you have two routes with identical /* patterns. You have two choices: • Change the new route’s “Pattern to match” to something more specific (e.g. /images/* or /media/*) and point it to the storage origin. • Keep the catch-all /* route but delete or disable the out-of-the-box default-route, then re-create your custom rule as the single /* entry.
   • Make sure you assign the correct priority (lower number = higher priority) so your storage route wins over any other.
2. Check DNS & custom domain setup
   • Your CNAME for cdn.pass-tickets.com must point to your Front Door endpoint (media-facgbpgthza3dhc2.z01.azurefd.net).
   • Give DNS changes 30–60 minutes to propagate before testing.
3. Purge & test
   • After you update the routes/origin-path, issue a full cache purge from the Front Door blade.
   • Use a tool like curl -v to inspect the x-cache response header (MISS vs HIT) and any X-Azure-Ref tracking reference for deeper troubleshooting.
4. Look at error details
   • What HTTP status code are you getting back? 404? 502? 403?
   • Grab the X-Azure-Ref header value from the failing request and run it through the Front Door diagnostics in the portal to see where the request is dropping off.

Reference Docs:

• https://learn.microsoft.com/en-us/azure/frontdoor/scenario-storage-blobs
• https://learn.microsoft.com/azure/frontdoor/integrate-storage-account?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider
• https://supportabilityhub.microsoft.com/solutions/apollosolutions/c266b0cd-20bd-92cf-5d40-8e9bec7fc478/715a4a2b-a082-41d3-9944-485a2442adf8
• https://supportabilityhub.microsoft.com/solutions/apollosolutions/c266b0cd-20bd-92cf-5d40-8e9bec7fc478/63a2832d-1cc9-414e-983b-e835094e2d4f

I hope this has been helpful!

If the above is unclear or you are unsure about something, please add a comment below.

If these answer your question, click "Upvote" and click "Accept Answer" which may be beneficial to other community members reading this thread.