You manage an Azure subscription containing a Recovery Services vault named rsv-prod-east and a Premium storage account named sa-finance-east in the East US region. The storage account hosts an SMB file share named accounting-records. The firewall of sa-finance-east is configured to restrict access to selected virtual networks. You attempt to configure backup for the accounting-records file share using the rsv-prod-east vault, but the storage account is not discovered during the configuration process. What should you configure to resolve this issue?
- AAssign the Storage File Data Privileged Contributor role to the Recovery Services vault's managed identity.
- BConfigure a private endpoint for the Recovery Services vault in the same subnet as the storage account.
- In the Firewalls and virtual networks settings of sa-finance-east, select 'Allow Azure services on the trusted services list to access this storage account'.Answer
- DAssign the Backup Operator role to the storage account's resource group.
Answer
In the Firewalls and virtual networks settings of sa-finance-east, select 'Allow Azure services on the trusted services list to access this storage account'.
The correct option is to enable the 'Allow Azure services on the trusted services list to access this storage account' setting under the Firewalls and virtual networks configuration of the storage account. Azure Backup is a trusted service, and enabling this exception allows the Recovery Services vault to bypass the firewall rules and successfully communicate with the storage account to discover and back up the SMB file share.
Step-by-Step Solution
Key Concept
Bypassing Azure Storage firewall using trusted Microsoft services exception for backup operations
Estimated Time:1m 30s