Default Access and Firewall Rules
Azure Storage accounts use firewall rules to provide granular network access control on public endpoints. By default, accounts allow traffic from all networks, so administrators must change the default action to deny to restrict access. Once denied, only explicitly allowed sources can connect to the storage resources. Firewall rules apply only to data plane operations, such as reading or writing blobs, and do not affect control plane operations like key regeneration.
Virtual Network and IP Network Rules
Virtual network rules allow access from specific subnets within your network. To enable this, administrators must turn on the Microsoft.Storage service endpoint on the subnet to keep traffic on the Azure backbone. IP network rules permit traffic from specific public internet IPv4 addresses using CIDR notation. IP rules do not affect traffic from the same Azure region, and small prefixes like /31 or /32 are not supported as ranges and must be added as individual IP addresses.
Trusted Service Exceptions
Authorized Microsoft services can bypass firewall restrictions using trusted service exceptions. These services, such as backup, monitoring, or logging, must use strong authentication to connect securely. These exceptions continue to function even if public network access is completely disabled.
Integrate Storage Accounts with Virtual Networks
Service Endpoints and Private Endpoints
Azure provides two primary methods for securing storage network integration. Service endpoints extend virtual network identity to Azure services, keeping traffic on the Azure backbone while continuing to use public IP addresses. In contrast, private endpoints assign a private IP address from the virtual network directly to the storage account. This completely blocks public access and allows secure connections from on-premises networks via VPN or ExpressRoute.
StudyCerts
StudyCerts