1

I have a storage account configured to be accessible via Private Link only as depicted below. Within the VNET MYSTORAGE.table.core.windows.net resolves to a private IP and the application works just fine. On the internet it resolves like this:

C:\>nslookup MYSTORAGE.table.core.windows.net 8.8.8.8                                                                               
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    table.sat03prdstr20a.store.core.windows.net
Address:  20.150.38.xxx
Aliases:  MYSTORAGE.table.core.windows.net
          MYSTORAGE.privatelink.table.core.windows.net

which I don't mind. But I don't understand why I'm able to connect to it:

C:\>telnet MYSTORAGE.table.core.windows.net 443

In my understanding once I disable 'All networks' I shouldn't be able to connect to it from the world. What am I missing?

enter image description here

Improve this question
2
  • 2
    Are you actually able to connect to the service using something like Azure Storage Explorer from outside? I would image that the endpoint will still accept inbound requests as it will be shared between many accounts, so a simple telnet would work, but as soon as you try and authenticate it will apply the network rules.
    – Sam Cogan
    Aug 12, 2020 at 13:36
  • @SamCogan, No, I can't connect with Storage Explorer getting "This request is not authorized to perform this operation." Is this by design?
    – UserControl
    Aug 12, 2020 at 16:06

1 Answer 1

Reset to default
1

Yes, this is by design. Azure Storage is a multi-tenant service. I would imagine that the endpoints you connect to to get into the service are shared between many customers and so allow all connections. It is at the point you try to access your specific storage account, that the network rules are applied and access is allowed or not.

If you cannot connect using storage explorer then it is working as expected.

Improve this answer
1
  • Thank you, Sam! Makes sense.
    – UserControl
    Aug 13, 2020 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .