An administrator is configuring Azure File Sync to synchronize files between an on-premises Windows Server and an Azure file share named share-a in a storage account named storagea. The on-premises server connects to an Azure virtual network using a Site-to-Site VPN. To meet security requirements, all synchronization traffic must traverse the VPN connection instead of the public internet. The administrator creates a private endpoint for the Storage Sync Service in the virtual network. Which configuration must be completed to ensure the on-premises server can successfully synchronize files with share-a?
- Create a private endpoint for storagea targeting the file sub-resource, and configure DNS resolution on-premises for both the Storage Sync Service and storagea private IP addresses.Cevap
- BConfigure a service endpoint for Microsoft.Storage on the gateway subnet, and add the public IP address of the on-premises server to the firewall of storagea.
- CCreate a second cloud endpoint in the sync group that maps to the private IP address of the Storage Sync Service private endpoint.
- DAssign the Storage File Data SMB Share Contributor role at the storage account level to the managed identity of the Storage Sync Service.
Cevap
Create a private endpoint for storagea targeting the file sub-resource, and configure DNS resolution on-premises for both the Storage Sync Service and storagea private IP addresses.
To route all Azure File Sync traffic over a private connection (such as a VPN or ExpressRoute), both the management endpoint (Storage Sync Service) and the data transfer endpoint (Storage Account File share) must have private endpoints configured. Additionally, the on-premises DNS must be configured to resolve these service endpoints to their respective private IP addresses instead of their public IPs.
Adım Adım Çözüm
Anahtar Kavram
Azure File Sync Private Endpoint Configuration