Azure Virtual Network Configuration Urgently Needed

I'm looking for Azure Storage and network expert, which can help me implement the security on the storage account and the storage account should only be accessible through a web app.

I have the sas token created for the blob, have the webapp deployed, but somehow I'm getting 403 when I try to access from the web app.