Appearntly, when origin is an Azure resource, like a WebApps or static website, etc, you must also include the parameter
--origin-host-header "$STORAGE_WEB_APP_URL"
otherwise all requests will fail.