openshift cluster with a web app behind an azure application gateway

I'm having trouble getting this setup to work. Everything I read tells me to point the AG at the RHOS internal LB for the backend pool, but the health probes fail with an error that they can't see the resource. I figure if there was something wrong with my HTTPS config I would get a different error. I set the only NSG to allow all from 10.0.0.0/8 to rule that out as an issue. I'm questioning the traffic returning to the AG because the internal LB has no place to configure outbound rules. I'm all out of ideas. The private DNS zone is linked. I've peered to a different vnet and setup a backend pool to DB servers there in a successful test. Has anyone got this kind of setup working with RHOS?