Question

Contoso hosts an internal application that must reach an Azure Storage account exclusively over a private connection. They have created a private endpoint for the storage account (blob subresource) in a hub VNet. On-premises servers connect to Azure through an ExpressRoute private peering circuit. From on-premises, application servers currently fail to connect to the storage account, and nslookup for the storage FQDN still returns a public IP address. What must Contoso do so that on-premises servers resolve the storage FQDN to the private endpoint's private IP?

Accepted Answer

Deploy a DNS forwarder VM in the hub VNet and configure on-premises DNS to conditionally forward the storage private DNS zone namespace to it, ensuring the forwarder queries Azure-provided DNS (168.63.129.16).

Answer

Add a virtual network link between the privatelink.blob.core.windows.net private DNS zone and the on-premises Active Directory domain.

Answer

Enable Microsoft peering on the ExpressRoute circuit so that on-premises servers can resolve Azure public DNS records privately.

Answer

Create a service endpoint for Microsoft.Storage on the hub VNet subnet and add the on-premises IP range to the storage account firewall.