You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Azure Storage accounts use firewall rules to provide granular network access control on public endpoints. By default, accounts allow traffic from all networks, so administrators must change the default action to deny to restrict access. Once denied, only explicitly allowed sources can connect to the storage resources. Firewall rules apply only to data plane operations, such as reading or writing blobs, and do not affect control plane operations like key regeneration.
Virtual network rules allow access from specific subnets within your network. To enable this, administrators must turn on the Microsoft.Storage service endpoint on the subnet to keep traffic on the Azure backbone. IP network rules permit traffic from specific public internet IPv4 addresses using CIDR notation. IP rules do not affect traffic from the same Azure region, and small prefixes like /31 or /32 are not supported as ranges and must be added as individual IP addresses.
Authorized Microsoft services can bypass firewall restrictions using trusted service exceptions. These services, such as backup, monitoring, or logging, must use strong authentication to connect securely. These exceptions continue to function even if public network access is completely disabled.
Azure provides two primary methods for securing storage network integration. Service endpoints extend virtual network identity to Azure services, keeping traffic on the Azure backbone while continuing to use public IP addresses. In contrast, private endpoints assign a private IP address from the virtual network directly to the storage account. This completely blocks public access and allows secure connections from on-premises networks via VPN or ExpressRoute.
A side-by-side architecture comparing service endpoints (traffic stays on Azure backbone, storage keeps a public IP) against private endpoints (private IP from the VNet assigned to storage, public access blocked, private DNS required, on-premises reach via VPN or ExpressRoute).
Service endpoints apply to all instances of a service, whereas private endpoints isolate access to a single resource. Private endpoints also offer data exfiltration protection but require extra costs, manual management, and private DNS configuration. Service endpoints are simpler to deploy because they do not require complex DNS changes.
To troubleshoot connectivity, verify that DNS correctly resolves the storage account name to its private IP address. Additionally, configure virtual network rules, check firewall logs, and implement role-based access control (RBAC) via Microsoft Entra ID instead of SAS tokens. Secure transit must also be enforced by requiring HTTPS for all connections.
Virtual network rules are preferred over public IP filtering because they prevent any public IPs from reaching the storage account. This significantly reduces the risk of unauthorized access from external networks. This configuration ensures that only traffic originating from authorized subnets can reach the data.
Configuring security rules involves enabling the service endpoint on a target subnet and creating a corresponding network rule on the storage account. In PowerShell, administrators use commands like Get-AzStorageAccount to retrieve the storage resource and Set-AzVirtualNetworkSubnetConfig to add the service endpoint. The rule is applied using Add-AzStorageAccountNetworkRule, and the default action is updated to deny using Update-AzStorageAccountNetworkRuleSet while allowing trusted services.
Prepare and test your skills
Prepare and test your skills
Service endpoints extend virtual network identity to Azure Storage while keeping traffic on the Azure backbone and using public IP addresses. Private endpoints assign a private IP from the virtual network to the storage account, completely blocking public access and allowing secure connections from on-premises via VPN or ExpressRoute. Private endpoints provide data exfiltration protection but require extra costs, manual management, and private DNS configuration, while service endpoints are simpler to deploy without complex DNS changes.
First, change the default action of the storage account firewall to deny, which restricts all traffic. Then enable the Microsoft.Storage service endpoint on the target subnet to keep traffic on the Azure backbone. Finally, create a virtual network rule on the storage account to allow access from that subnet. In PowerShell, use commands like Get-AzStorageAccount, Set-AzVirtualNetworkSubnetConfig, Add-AzStorageAccountNetworkRule, and Update-AzStorageAccountNetworkRuleSet to apply these settings.
Trusted service exceptions allow authorized Microsoft services, such as backup, monitoring, or logging, to bypass firewall restrictions. These services must use strong authentication to connect securely. These exceptions continue to function even if public network access is completely disabled.
StudyCerts
StudyCerts