Question

Your company stores FSLogix profile containers on an Azure Files premium share. Security requires that the storage account deny access from the public internet, but session hosts in the AVD subnet must still mount the share with low latency and no traffic traversing the internet. You want to avoid deploying additional resources such as private endpoints if a simpler option meets the requirement. What should you configure on the storage account?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the AVD subnet and add that subnet to the storage account's firewall allowed virtual networks

Answer

Set the storage account's public network access to 'Enabled from all networks' and rely on NTFS permissions to restrict access

Answer

Configure a NAT gateway on the AVD subnet so outbound traffic uses a static public IP added to the storage firewall

Answer

Enable the 'Allow trusted Microsoft services' exception on the storage account firewall