I have this setup:

  1. a storage account
  2. a webapp
  3. a VNET with two subnets
  4. a private link

The private link is in subnet A, and the webapp is delegated to subnet B. I have a the private link assigned to the storage account

Storage account private connection

This is actually working. I can see that the IP is from the subnet A range, when doing nameresolving


And I can perfectly request data from the storage account.

Now i want to cut of the public traffic. The only way i do this, as i see it, is to disallow traffic from all networks

Allow traffic from no networks

But now i can't request data from my storage account. The nameresolving is still working fine, and the internal IP does get resolved.

I am most certainly doing this wrong. How can i deny traffic from public endpoint, and only allow traffic from my internal IP?

A workaround, as I see it, is to add the subnet B på the allowed network list. If i do this, a storage service endpoint is being added to the subnet, the nameresolving is still resolving the internal IP, and i can get data.

Is this workaround, the only, and proper way of doing this?


Currently, yes. Although the web app will communicate to the storage account via the private endpoint, this specific configuration still requires the storage account to have public access (not sure if you can firewall the entire public IP range and it’ll still work).

My apologies. I’ve deployed this configuration before into a test environment and found the MS docs that say it’s not possible at this point in time but cannot find the link now.

  • I see. So there is still a public IP, but because of the storage service endpoint attached to the subnet, the traffic gets tagged, and the public traffic gets denied. It sounds like a solution. Not the perfect one, but still the best under the circumstances. – mslot Mar 6 at 10:06
  • I don't think that's the intention but it's a current issue atm. My setup was using App Service for Containers and mounting an Azure File Share into the container. It went via the private link but would stop working if I disabled "Public Access" to the storage account in the firewall. It was specifically called out on one of the Azure Docs pages but I can't easily find it atm. – Greg W Mar 6 at 10:40
  • As i see it, we should actually be able to tell the firewall to "shutdown public access", and then we dont need to use the service point trick. – mslot Mar 6 at 16:58
  • Agreed. I’m sure they’ll make it work eventually. – Greg W Mar 6 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.