An administrator is setting up a backup policy for a file share hosted in Azure. The resources are configured as follows:
- Storage Account: `sa-finance-prod` (Standard general-purpose v2, configured with a storage firewall restricting access to selected networks)
- File Share: `fin-share-main` (SMB file share)
- Region: East US
- Backup Target: A Recovery Services vault named `rsv-finance` in the East US region
During the backup configuration wizard inside the Recovery Services vault, the administrator cannot find the `sa-finance-prod` storage account to select it.
Which of the following actions will resolve this discovery issue?
- Select the option to allow trusted Microsoft services to bypass the firewall in the storage account network settings.Answer
- BGrant the Backup Operator role to the Recovery Services vault's managed identity on the storage account.
- CAdd the outbound IP addresses of the Recovery Services vault to the firewall allowed list on the storage account.
- DConvert the SMB file share to an NFS file share to allow backup traffic to bypass network security controls.
Answer
Select the option to allow trusted Microsoft services to bypass the firewall in the storage account network settings.
The correct answer is to select the option to allow trusted Microsoft services to bypass the firewall in the storage account network settings. When a storage account's firewall is enabled, Azure Backup (which runs as a trusted Microsoft service) is blocked from accessing the storage account control and data planes unless this specific exception is configured in the firewalls and virtual networks settings of the storage account.
Step-by-Step Solution
Key Concept
Azure Backup requires the 'Allow trusted Microsoft services' bypass to access Azure File Shares in storage accounts protected by firewalls.
Estimated Time:45s