Configure CORS on the storage account

Without this step, uploads from the browser fail with a CORS error in the browser console, while server-side calls from Salesforce to Azure keep working. So the symptom is “uploads from the UI fail but admin diagnostics pass”, which is easy to misdiagnose.

The same GET rule also powers the photo editor. Large images, over Salesforce’s 4 MB server-side limit, load straight into the canvas from your container. Without GET in the CORS rule, or if your Salesforce origin is not listed, large external images open in view-only mode instead of being editable. Editing is capped at 50 MB.

CORS in Azure is set at the storage account level, not the container level. It applies to every container in the account. Looking for it on the container is the most common wrong turn here.

Add the CORS rule

1. Open the storage account.
2. In the left sidebar under Settings, click Resource sharing (CORS).
3. Make sure the Blob service tab is selected. The other tabs are for files, queues, and tables, which are not used here.
4. Add a new row, or fill in the first empty row:
   • Allowed origins - a comma-separated list of every Salesforce domain users will upload from. For example:

     https://your-org.lightning.force.com,https://your-org.my.salesforce.com,https://your-org.sandbox.my.salesforce.com,https://your-experience-site.my.site.com

   • Allowed methods - check GET, PUT, HEAD.
   • Allowed headers - *
   • Exposed headers - ETag
   • Max age - 3000
5. Click Save at the top.

Finding your Salesforce domains: in Salesforce Setup → My Domain, the Current My Domain URL and Lightning URL are the two you need for the production org. Sandboxes have their own equivalents. Experience Cloud sites appear in Setup → Digital Experiences → All Sites.

Next: Get the account name and key.