Images hosted in azure blob storage not displaying in AZ Managed Grafana workspace

Question

Images hosted in azure blob storage not displaying in AZ Managed Grafana workspace

Javier Huamani 100

Currently, we host images to use for our Azure Managed Grafana workspaces in azure blob storage. However, since last week we've noticed that all our images appear blank or show a default logo:

User's image

We reviewed the console for insight into this issue and found the root cause is due to the Content Security Policy (CSP), specifically this directive being violated:

img-src 'self' data: *.storyblok.com azure.microsoft.com *.basemaps.cartocdn.com tile.openstreetmap.org services.arcgisonline.com

Since we can't modify the CSP ourselves to add our storage account URI, our images are being blocked. Is it possible to update the CSP to allow blobs from azure storage accounts? Otherwise, what alternative hosting options do we have for images?

Suchitra Suregaunkar 13,785 Reputation points Microsoft External Staff Moderator

2026-04-16T18:28:57.5566667+00:00
Hello Javier Huamani

Thanks for raising this query. It is a known, recently introduced issue affecting multiple Azure Managed Grafana customers. The root cause is exactly what you identified is that a recent change in the Content Security Policy (CSP) enforced by the Azure Managed Grafana service now blocks images from domains not explicitly listed in the img-src directive, including Azure Blob Storage endpoints (*.blob.core.windows.net).

Azure Managed Grafana is a fully managed service operated by Microsoft. As part of the managed service model, Microsoft controls server-level security settings including HTTP response headers like CSP and customers cannot modify them.

Reference: Azure Managed Grafana service limits.

The only Grafana settings exposed to customers today are: External Enabled, Viewers Can Edit, Editors Can Admin, CSRF Always Check, and Capture Enabled (Preview). CSP configuration is not among them.

In self-hosted Grafana, CSP is configurable through grafana.ini under the security hardening settings but since Azure Managed Grafana does not expose the server configuration file, there is no customer-facing way to add your storage account domain to the img-src allowlist.

This issue has been reported to the Azure Managed Grafana product team through the official GitHub repository

Reference: Issue #60 — Breaking change: CSP blocks external images.

The team has acknowledged the problem and confirmed they are actively working on a solution. GeoMap tile images (CartoDB, OpenStreetMap, ESRI) have already been restored, but images from Azure Blob Storage endpoints remain blocked as of now.

As a workaround:

Embed small images as Base64 data: URLs — The current CSP explicitly allows data: in the img-src directive, so Base64-encoded inline images will render. This is practical for logos and small static assets.

Open a support ticket — Since this requires a platform-level fix from Microsoft, raising a support request through the Azure portal will help track the resolution and may accelerate the timeline.

I have requested few details via Private Message to create ticket with Backend team. Could you please share it with us?

Thanks,
Suchitra.
Suchitra Suregaunkar 13,785 Reputation points Microsoft External Staff Moderator

2026-04-24T16:41:41.9333333+00:00

Hello Javier Huamani

As we have created support case to backend team, the Product Group has rolled out a patch to update the Content Security Policy (CSP), and this change has already been deployed to the South Central US region.

Could you please try accessing your dashboards again and confirm if the images hosted in Azure Blob Storage are now rendering as expected?

If the issue persists

If you are still experiencing the issue, I would request you to please share:

A screenshot of the dashboard

The exact error message from the browser console (if available)

This will help us investigate further on priority. Looking forward to your confirmation.

Thanks,

Suchitra.

Answer accepted by question author

1 additional answer

Your answer

Suchitra Suregaunkar 13,785 Reputation points Microsoft External Staff Moderator

2026-04-24T16:41:41.9333333+00:00

Hello Javier Huamani

As we have created support case to backend team, the Product Group has rolled out a patch to update the Content Security Policy (CSP), and this change has already been deployed to the South Central US region.

Could you please try accessing your dashboards again and confirm if the images hosted in Azure Blob Storage are now rendering as expected?

If the issue persists

If you are still experiencing the issue, I would request you to please share:

A screenshot of the dashboard

The exact error message from the browser console (if available)

This will help us investigate further on priority. Looking forward to your confirmation.

Thanks,

Suchitra.

Answer 1

Hello Javier Huamani

Thank you for posting your query on Microsoft Q&A platform.

The root cause is a Content Security Policy (CSP) violation related to the img-src directive in Azure Managed Grafana. The CSP restricts image sources and does not include the Azure Blob Storage domain (*.blob.core.windows.net), causing the images to be blocked from rendering. This platform-level CSP enforcement limits the domains allowed for image hosting, which the customer cannot modify themselves.

Backend team provided an explanation of the CSP enforcement and its limitations, confirming that Azure Managed Grafana enforces a strict CSP that excludes the customer's blob storage domain. Alternative approaches such as base64 embedding were discussed but found not scalable.

As we have created support case to backend team, support initiated engagement with subject matter experts (SMEs) and created an internal incident (ICM) to address the issue further.

Later the Product Group has rolled out a patch to update the Content Security Policy (CSP), and this change has already been deployed to the South Central US region.

Thanks,
Suchitra.

Suchitra Suregaunkar 13,785 Reputation points Microsoft External Staff Moderator

2026-04-28T11:22:44.55+00:00

Hello Javier Huamani

As the issue has been resolved, could you please click "Accept Answer" & "upvote" it and this helps other community members who may encounter a similar issue in the future.

If you’re still experiencing the problem or need further clarification, please feel free to share additional information so we can continue investigating and assist you further.

Thanks,

Suchitra.

Answer 2

The Content Security Policy applied to Azure Managed Grafana is controlled by the service and can’t be customized per workspace, so adding an arbitrary Azure Storage account domain to img-src isn’t supported.

Because the CSP only allows images from the explicitly listed domains ('self' data: *.storyblok.com azure.microsoft.com *.basemaps.cartocdn.com tile.openstreetmap.org services.arcgisonline.com), images served directly from generic Azure Blob Storage endpoints will be blocked, as observed in the browser console.

Given this limitation, the practical options are:

Host images on a domain that is already permitted by the CSP. For example, if there is an existing, CSP-allowed image host used in the environment (such as a corporate site that proxies or serves the required images) and it falls under one of the allowed domains, use that instead of direct Blob Storage URLs.
Use data URLs (data:) for small, static images (for example, logos) where feasible, since data: is explicitly allowed in the img-src directive.
If organizational policy requires Azure-based hosting, front the images through an approved domain (for example, a web app or CDN endpoint that is on an allowed host) rather than using the raw *.blob.core.windows.net URLs.

Directly relaxing or extending the Managed Grafana CSP to include arbitrary *.blob.core.windows.net or specific storage account hostnames is not available as a configuration option; any change would require a platform-level update by the service team.

References:

Share via

Images hosted in azure blob storage not displaying in AZ Managed Grafana workspace

1 additional answer

Your answer