MI edits+TOC

Author: Harikrishnan-M-B

articles/frontdoor/media/managed-identity/storage-job-function-roles.png

@@ -13,7 +13,7 @@ ms.date: 05/12/2025
 
 Managed identities provided by Microsoft Entra ID enables your Azure Front Door Standard/Premium instance to securely access other Microsoft Entra protected resources, such as Azure Blob Storage, without the need to manage credentials. For more information, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md).
 
-After you enable managed identity for Azure Front Door and granting the managed identity necessary permissions to your origin, Front Door will use the managed identity to obtain an access token from Microsoft Entra ID for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme. Front Door caches the token until it expires. 
+After you enable managed identity for Azure Front Door and granting the managed identity necessary permissions to your origin, Front Door will use the managed identity to obtain an access token from Microsoft Entra ID for accessing the specified resource. After successfully obtaining the token, Front Door will set the value of the token in the Authorization header using the Bearer scheme and then forward the request to the origin. Front Door caches the token until it expires. 
 
 > [!Note]
 > This feature is not currently supported for private link enabled origins within Front Door.
@@ -68,7 +68,11 @@ Before setting up managed identity for Azure Front Door, ensure you have an Azur
 ## Associating the identity to an Origin Group
 
 > [!Note]
-> The association will not work if the origin group contains any origins with private link enabled and/or the forwarding/accepted/health probe protocol is set to HTTP.
+> The association will only work if
+> 1) the origin group does not contain any origins with private link enabled.
+> 2) the health probe protocol is set to 'HTTPS' under origin group settings.
+> 3) the forwarding protocol is set to 'HTTPS Only' under route settings.
+> 4) the forwarding protocol is set to 'HTTPS Only' in case you are using a 'Route configuration override' action in rulesets.
 
 1.	Navigate to your existing Azure Front Door profile and open origin groups.
 2.	Select an existing origin group which has origins already configured.
@@ -80,8 +84,6 @@ Before setting up managed identity for Azure Front Door, ensure you have an Azur
 
     :::image type="content" source="./media/managed-identity/origin-auth.png" alt-text="Screenshot of associating the identity to an origin group.":::
 
-
-
 ## Providing access at the origin resource
 1.	Navigate to the management page of your origin resource. For example, if the origin is an Azure Blob Storage, go to that Storage Account management page.
 
@@ -90,18 +92,19 @@ Before setting up managed identity for Azure Front Door, ensure you have an Azur
 
 2. Go to the **Access Control (IAM)** section and click on **Add**. Choose **Add role assignment** from the dropdown menu.
     :::image type="content" source="./media/managed-identity/add-role-assignment-menu.png" alt-text="Screenshot of access control settings.":::
-3.	Under **Job function roles** in the **Roles** tab, select an appropriate role (for example, Storage Blob Data Reader or Storage Blob Data Contributor) from the list and then select **Next**.
+3.	Under **Job function roles** in the **Roles** tab, select an appropriate role (for example, Storage Blob Data Reader) from the list and then select **Next**.
     :::image type="content" source="./media/managed-identity/storage-job-function-roles.png" alt-text="Screenshot of Roles tab under Add role assignment.":::
 4.	In the **Members** tab, under the **Assign access to**, choose **Managed identity** and then click on **Select members**.
     :::image type="content" source="./media/managed-identity/members.png" alt-text="Screenshot of Members tab under Add role assignment.":::
 5.	The **Select managed identities** window opens. Choose the subscription where your Front Door is located and under **Managed identity** dropdown, choose **Front Door and CDN profiles**. Under the **Select** dropdown, choose the managed identity created for your Front Door. Click on the **Select** button in the bottom.
 6.	Select **Review and assign** and then select **Review and assign** once more after the validation is complete.
 
 
-## Common Troubleshooting Tips
-* Error during origin group configuration.
-    * Ensure that health probe protocol is set to HTTPS.
-    * Ensure that forwarding protocol and accepted protocols within route settings are HTTPS.
+## Tips while using origin authentication
+* If you are facing errors during origin group configuration,
+    * Ensure that the health probe protocol is set to HTTPS.
+    * Ensure that forwarding protocol within route settings and/or route configuration override settings (in rulesets) is set to 'HTTPS Only'.
     * Ensure that there are no private link enabled origins within the origin group.
-* Access Denied: Verify that the Managed Identity has the appropriate role assigned to access the origin resource.
+* If you see 'Access Denied; responses from origin, verify that the Managed Identity has the appropriate role assigned to access the origin resource.
 * Transition from SAS Tokens for Storage: If transitioning from SAS tokens to Managed Identities, follow a step-wise approach to avoid downtime. Enable Managed Identity, associate it with the origin, and then stop using SAS tokens.
+* After you enable origin authentication in origin group settings, you should not directly disable/delete the identities from the Identity settings under Front Door portal, nor directly delete the user-assigned managed identity under the Managed Identity portal. Doing so will cause origin authentication to fail immediately. Instead, if you want to stop using the origin authentication feature or want to delete/disable the identities, first disable the access restrictions under the Access Control (IAM) section of the origin resource so that the origin is accessible without the need of a managed identity or Entra ID token. Then disable origin authentication under Front Door origin group settings. Wait for some time for the configuration to be updated and then delete/disable the identity if required.