Question

Your company hosts a general-purpose v2 storage account named 'salesdata'. You create a private endpoint for the blob sub-resource in a spoke VNet, approve the connection, and configure the private DNS zone integration correctly. Application VMs in the spoke VNet can resolve the storage account FQDN to the private IP address, but they still receive '403 Authorization Failure' errors when accessing blobs. The storage account's networking firewall is set to 'Enabled from selected virtual networks and IP addresses' with no networks or IPs added. What should you do to allow access while keeping the account private?

Accepted Answer

On the storage account firewall, ensure the 'Disable' public network access setting is selected, or leave the firewall in place — private endpoint traffic is not affected by the storage account firewall rules.

Answer

Add the spoke VNet subnet as a service endpoint entry under the storage account firewall's virtual network rules.

Answer

Add the private endpoint's private IP address to the storage account firewall's IP address range allow list.

Answer

Change the storage account firewall to 'Enabled from all networks' so the private endpoint traffic is permitted.