Quartz 5

storage-network-rule

Properties2
tagsstorage, security, networking, firewall, private-endpoint, az-104
aliasesstorage firewall, network rules, service endpoint, private endpoint, trusted Microsoft services, public network access

3 min read

Storage firewall & network access (network rules)

What it is

Storage network rules control which network sources may reach a storage account’s public endpoint. By default, storage accounts allow connections from any network. A team can restrict the public endpoint to selected sources or disable public network access and use a private design instead.

Why it exists

Storage can hold sensitive data. Restricting the network surface reduces exposure by requiring a request to originate from an approved network source. The request must still meet its authorization requirements.

Key ideas

  • Virtual-network rules: allow selected subnets through the public endpoint. The subnet needs the appropriate Storage service endpoint; use Microsoft.Storage for same-region storage and Microsoft.Storage.Global when cross-region access is needed, not both on the same subnet.
  • IP network rules: allow selected public IP ranges, commonly an on-premises egress address. They are not a substitute for identity authorization.
  • Resource-instance rules: allow certain Azure resource instances that cannot be isolated through VNet or IP rules.
  • Trusted-service exceptions: allow specific supported Azure services outside the configured network boundary. Enable only the exception a design needs; do not treat it as a general bypass for every Azure tool.
  • Private Endpoints: create a private IP for a specific storage subresource such as Blob or File. They are a different connectivity path from public-endpoint firewall rules.
  • Pair network rules with SAS, access keys, or data-plane RBAC. A request from an allowed network can still be denied for lack of authorization.

Northwind example

Northwind’s app subnet uses a Storage service endpoint, and Maya adds a virtual-network rule for that subnet on the order-document storage account. The account’s public endpoint now rejects other sources unless another rule allows them. Its warehouse system, which is outside Azure, uses an IP rule for its known egress address. Luis’s app still needs a correctly authorized identity to write a blob. For a stricter private-only architecture, the team uses a Private Endpoint and designs its private DNS resolution.

Exam notes

  • Network rules are separate from authentication — they filter who can reach the endpoint, not what they may do.
  • Private Endpoint gives a storage subresource a private IP; a service endpoint continues to use the storage public endpoint but limits it to allowed subnets.
  • Test every dependency before restricting network access. Do not broadly enable trusted-service exceptions as a shortcut.

storage-account · sas-token · storage-access-keys

📘 Source: Microsoft Learn — Azure Storage firewall rules and network access

Graph View

Backlinks