Skip to content

az storage account create encountering "NetworkAclsValidationFailure" with exit code 0 #32434

@tdihp

Description

@tdihp

Describe the bug

Hi, I'm trying to enable nfsv3 for blob storage. I'm getting this error message in the result:

{
...
  "error": {
    "code": "NetworkAclsValidationFailure",
    "message": "Validation of network acls failure: SubnetsHaveNoServiceEndpointsConfigured:Subnets aks of virtual network /subscriptions/<redacted>/resourceGroups/<redacted>/providers/Microsoft.Network/virtualNetworks/<redacted> do not have ServiceEndpoints for Microsoft.Storage resources configured. Add Microsoft.Storage to subnet's ServiceEndpoints collection before trying to ACL Microsoft.Storage resources to these subnets.."
  },
...
}

It is very easy to replicate:

  1. create a $RG + $VNET/$SUBNETsubnet pair
  2. run below
az storage account create -g $RG -n $NAME \
    --sku Standard_LRS \
    --kind StorageV2 \
    --enable-nfs-v3 --hns \
    --default-action Deny \
    --subnet "$SUBNET" --vnet-name "$VNET" --action "allow" \
    --min-tls-version TLS1_2

echo $?
# we found 0 even with error above shown

Related command

az storage account create

Errors

See above description, notice that it should be an error response, but exit code is zero

Issue script & Debug output

it is already apparent, don't think debug needed, but let me know

Expected behavior

should exit 1 instead

Environment Summary

azure-cli 2.79.0 *

core 2.79.0 *
telemetry 1.1.0

Extensions:
aks-preview 19.0.0b16
azure-iot-ops 0.4.0b3
k8s-configuration 2.0.0
k8s-extension 1.6.1
resource-graph 2.1.0
ssh 2.0.6

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/az/bin/python3'
Config directory '/home/ubuntu/.azure'
Extensions directory '/home/ubuntu/.azure/cliextensions'

Python (Linux) 3.13.9 (main, Oct 28 2025, 09:10:27) [GCC 11.4.0]

Legal docs and information: aka.ms/AzureCliLegal

You have 2 update(s) available. Consider updating your CLI installation with 'az upgrade'

Additional context

No response

Metadata

Metadata

Assignees

Labels

Auto-AssignAuto assign by botAuto-ResolveAuto resolve by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamStorageaz storageUpgradeaz upgradequestionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions