Azure Storage firewall restricts requests to a storage account by network location or trusted Azure resource source. Because new accounts expose a public endpoint and accept connections from any network by default, use the firewall to block public traffic and permit only required networks. section 5.1 section 5.1.1
A practical restriction sequence is:
- Set the storage account default action to Deny, blocking requests except those matching permitted rules. section 5.1.1
- Enable the Microsoft.Storage service endpoint on the required VNet subnet before adding its network rule. section 5.1.1
- Add rules for approved VNet subnets and trusted public IPv4 addresses or CIDR ranges; both rule types can coexist. section 5.1.1
Restricting storage to an application subnet
A storage account used by virtual machines in VNET1 and VMSubnet can deny public traffic, enable the Microsoft.Storage endpoint on VMSubnet, and allow that subnet. A separate rule can allow 13.14.15.0/24 when trusted external clients need access. section 5.1.1
