How to Create a Private Endpoint for an Azure Storage Account

An Azure Storage private endpoint gives a storage service a private IP address from a virtual network. Clients in that network can continue using the normal storage connection string while DNS routes the connection to the private endpoint. [1]

Before you begin

Prepare the storage account, the target virtual network and subnet, and the identity needed to approve the connection. Decide which storage service needs private access: Blob, Data Lake Storage, Files, Queues, Tables, or Static Websites. Azure requires a separate private endpoint for each storage resource you need to access. [1]

1. Start the private endpoint in Azure

1. Open the Azure portal and search for Private endpoints.
2. Select + Create.
3. On Basics, choose the subscription, resource group, name, and region.
4. Select Next: Resource.
5. Choose Connect to an Azure resource in my directory, then select the subscription, storage account resource type, storage account, and target sub-resource.

The target sub-resource is the storage service endpoint, such as blob or file. If you use Data Lake Storage capabilities, Microsoft recommends creating private endpoints for both the Blob and Data Lake Storage resources when the workload needs both endpoint types. [1]

2. Select the virtual network and subnet

1. Select Next: Virtual Network.
2. Choose the virtual network and subnet where clients will connect from.
3. Review private-endpoint network policies for the subnet and apply the network policy configuration required by your design.
4. Choose dynamic or static private IP allocation according to your address-management standards.

Keep the private endpoint in a subnet that has the routing and security controls required by the application. A private endpoint is not a replacement for identity permissions, storage authorization, or monitoring.

3. Configure private DNS

On the DNS tab, review the private DNS zone option. Azure normally creates or updates the appropriate private DNS zone and records. Clients inside the virtual network should resolve the ordinary storage endpoint name to the private endpoint IP. Microsoft says to keep using the same storage connection string rather than connecting directly to a privatelink URL. [1]

If the environment uses a custom or on-premises DNS server, configure it to resolve the storage account’s private-link name to the private endpoint address, either by delegation to the Azure private DNS zone or with the appropriate records.

4. Review and create

1. Open Tags if your organization requires cost, owner, or environment tags.
2. Select Review + create.
3. Resolve validation issues, then select Create.
4. If the connection requires approval, have the storage account owner review and approve the private endpoint request from the storage account’s Private endpoints area.

5. Restrict the public endpoint carefully

After private connectivity works, decide whether the storage account should still accept public connections. Microsoft documents using the storage firewall to deny or control access through the public endpoint. The firewall does not need a separate virtual-network rule for traffic using a private endpoint. [1]

Do not disable public access first unless you have already tested DNS, routing, the target sub-resource, and every client path that needs the storage account. Storage copy operations also require network access to both the source and destination accounts.

6. Test from inside the virtual network

1. From a VM, app, or other client in the connected virtual network, resolve the normal storage endpoint name.
2. Confirm that DNS returns the private endpoint address from inside the network.
3. Use the application’s normal connection string and perform a controlled read and write test.
4. Test from an unauthorized network if the public endpoint is supposed to be blocked.

Common mistakes

• Creating a Blob private endpoint but forgetting the File, Queue, Table, or Data Lake endpoint the application actually uses.
• Using the privatelink URL directly instead of the normal storage endpoint.
• Creating the endpoint but leaving custom DNS unable to resolve the private address.
• Blocking public access before confirming all required clients use the private path.

Sources

1. Microsoft Learn: Use private endpoints — Azure Storage
2. Microsoft Learn: Quickstart — Create a private endpoint in the Azure portal