Storage firewall & network access (network rules)
What it is
Storage network rules control where data-plane traffic may come from. By default a storage account is publicly reachable; you can lock it down to Allow access from selected networks (specific VNets/subnets and IP ranges) or Disabled (no public endpoint).
Why it exists
Storage holds sensitive data. Restricting the network surface reduces attack/exfiltration risk and lets you enforce that only traffic from your VNets/on-prem trusted ranges can reach it.
Key ideas
- Public network access: All networks vs Selected networks vs Disabled.
- Virtual network rules — authorize specific VNet/subnets (via service endpoints or private endpoints).
- IP rules — allow specific public IP ranges (e.g., your office or Azure IPs).
- Private endpoints — assign a private IP inside your VNet to the storage account (or to specific subresources like
blob/file), removing it from the public internet. - Trusted Microsoft services exception lets Azure services (Backup, Log Analytics, AzCopy w/ managed identity) bypass the firewall when enabled.
- Applies at the storage account level; combined with SAS/keys/RBAC for defense-in-depth.
How it fits (diagram)
Exam notes
- Network rules are separate from authentication — they filter who can reach the endpoint, not what they may do.
- Private endpoint puts storage on a private IP in your VNet (most secure); service endpoint uses the public IP but restricted to the subnet.
- When locking down, remember the trusted services exception or your backups/AzCopy will fail.
- Restrict both the management and data planes where applicable.
Related
storage-account · sas-token · storage-access-keys
📘 Source: Microsoft Learn — Storage Network Rule