Your company has an on-premises datacenter connected to an Azure virtual network using a Site-to-Site VPN. An on-premises server named Server1 runs the Azure File Sync agent. You have an Azure storage account named storagedata1 that contains an Azure file share named share1. To comply with security policies, the firewalls and virtual networks settings for storagedata1 are configured to allow access only from selected networks. You need to ensure that Server1 can synchronize files with share1 over the VPN connection. Which of the following configurations should you implement?
- Configure a private endpoint for the file service of storagedata1 within the Azure virtual network.Answer
- BEnable the 'Allow trusted Microsoft services to access this storage account' setting on the firewall of storagedata1.
- CAssign the Storage Blob Data Contributor role for storagedata1 to the registered server's managed identity.
- DGenerate a Shared Access Signature (SAS) token for storagedata1 and import it using the Azure File Sync agent on Server1.
Answer
Configure a private endpoint for the file service of storagedata1 within the Azure virtual network.
Configuring a private endpoint for the file service of the storage account is the correct solution. It allows the on-premises server, connected via Site-to-Site VPN, to route synchronization traffic to the private IP of the file share, bypassing the public firewall restriction.
Step-by-Step Solution
Key Concept
Azure File Sync network configuration with storage firewalls