You need to restrict network access to an Azure Storage account named `store77` so that it is only accessible from a subnet named `Subnet1` within a virtual network named `VNet1` using the Azure backbone network. Which two configurations should you implement?
- Configure the network firewall settings of `store77` to allow access from selected virtual networks and add `VNet1` and `Subnet1`.Answer
- Configure the `Microsoft.Storage` service endpoint on `Subnet1`.Answer
- CAssign the Storage Blob Data Reader role at the storage account scope to the virtual machines in `Subnet1`.
- DEnable the 'Allow trusted Microsoft services to access this storage account' firewall bypass on `store77`.
Answer
Configure the network firewall settings of the storage account to allow access from selected virtual networks and add the virtual network and subnet, and configure the storage service endpoint on the subnet.
To restrict network access to a specific subnet over the backbone network, you must perform two main configurations: first, configure the subnet to use the `Microsoft.Storage` service endpoint, which optimizes the network route; second, configure the storage account firewall to allow traffic from that specific virtual network and subnet combination.
Step-by-Step Solution
Key Concept
Securing Azure Storage network access requires both enabling a service endpoint on the source subnet and configuring the storage account firewall to permit traffic from that specific subnet.