I'm an IT professional at a small company that relies heavily on Microsoft 365 and SharePoint, but we have limited Azure experience. I want to host an interactive, static HTML dashboard in Azure Storage Blob and display it through an embedded link on a SharePoint site. A Power Automate flow would periodically replace the existing index page with an updated version.
The problem is that Azure Blob static website URLs are publicly reachable. Our users work remotely, and their IP addresses change frequently, so IP allowlists are not practical. Requiring everyone to use a corporate VPN would also mean configuring and supporting several hundred laptops, which I'd prefer to avoid.
I've considered Azure Front Door or a CDN with Private Link, but I'm not sure that approach provides the browser-based access model I need for remote users. The dashboard must remain accessible through a URL because it is an interactive HTML page.
Is there a practical way to keep the dashboard unavailable to the general public while allowing authenticated employees to access it from SharePoint? I'd prefer to use Microsoft Entra ID authentication, existing Microsoft 365 identities, and possibly device or conditional-access policies if appropriate.
5 Answers
Regardless of which hosting service you choose, put authentication in front of anything containing sensitive information. Entra ID sign-in, MFA, and Conditional Access based on device compliance or user risk would provide much stronger protection than trying to restrict access by IP address. A public URL is not a security boundary, even if the address is difficult to guess.
Another straightforward design is Azure App Service with Entra authentication enabled. App Service makes it easy to put an authentication gate in front of the site, while the dashboard can still be served as static files. This is often easier to reason about than trying to make a public Storage static website private through networking controls.
The simplest option may be to host the dashboard directly in SharePoint instead of exposing a separate public blob website. If the HTML can be stored or embedded there, SharePoint authentication and permissions handle access automatically, and Power Automate can update the content. That avoids adding a separate authentication layer and keeps the whole experience inside your existing Microsoft 365 environment.
If your organization already has the necessary licensing, Entra Private Access could provide another way to publish the application to authenticated users without relying on fixed IP addresses or a traditional site-to-site VPN. Users would access it through their work identity and the approved application, rather than exposing the storage endpoint to everyone.
If you want to keep it as a separate web application, Azure Static Web Apps supports Microsoft Entra ID authentication and is a good fit for a static HTML dashboard. You can require users to sign in with their organization accounts, then use Conditional Access or other Entra policies to control access. It also works well with automated deployments when the generated index page changes.
Static applications can also be published through the user's application portal, so this does not necessarily require converting the dashboard into a dynamic application.