Skip to content

Commit 3d2ba6d

Browse files
normestanormesta
committed
Some content reorgs
1 parent 5ec2649 commit 3d2ba6d

7 files changed

+312
-339
lines changed

‎articles/storage/.openpublishing.redirection.storage.json

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1575,71 +1575,6 @@
15751575
"redirect_url": "/previous-versions/azure/storage/storage-common-transfer-between-storage-accounts",
15761576
"redirect_document_id": false
15771577
},
1578-
{
1579-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#change-the-default-network-access-rule",
1580-
"redirect_url": "/azure/storage/common/storage-network-security-set-default-access",
1581-
"redirect_document_id": false
1582-
},
1583-
{
1584-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#configuring-access-from-on-premises-networks",
1585-
"redirect_url": "/azure/storage/common/storage-network-security-ip-address-range#configuring-access-from-on-premises-networks",
1586-
"redirect_document_id": false
1587-
},
1588-
{
1589-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#exceptions",
1590-
"redirect_url": "/azure/storage/common/storage-network-security-manage-exceptions",
1591-
"redirect_document_id": false
1592-
},
1593-
{
1594-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#manage-exceptions",
1595-
"redirect_url": "/azure/storage/common/storage-network-security-manage-exceptions",
1596-
"redirect_document_id": false
1597-
},
1598-
{
1599-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#trusted-access-for-resources-registered-in-your-microsoft-entra-tenant",
1600-
"redirect_url": "/azure/storage/common/storage-network-security-manage-exceptions#trusted-access-for-resources-registered-in-your-microsoft-entra-tenant",
1601-
"redirect_document_id": false
1602-
},
1603-
{
1604-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#grant-access-from-an-internet-ip-range",
1605-
"redirect_url": "/azure/storage/common/storage-network-security-ip-address-range",
1606-
"redirect_document_id": false
1607-
},
1608-
{
1609-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#managing-ip-network-rules",
1610-
"redirect_url": "/azure/storage/common/storage-network-security-ip-address-range#managing-ip-network-rules",
1611-
"redirect_document_id": false
1612-
},
1613-
{
1614-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#grant-access-from-a-virtual-network",
1615-
"redirect_url": "/azure/storage/common/storage-network-security-virtual-networks",
1616-
"redirect_document_id": false
1617-
},
1618-
{
1619-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#grant-access-to-trusted-azure-services",
1620-
"redirect_url": "/azure/storage/common/storage-network-security-manage-exceptions",
1621-
"redirect_document_id": false
1622-
},
1623-
{
1624-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#trusted-microsoft-services",
1625-
"redirect_url": "/azure/storage/common/storage-network-security-manage-exceptions#trusted-microsoft-services",
1626-
"redirect_document_id": false
1627-
},
1628-
{
1629-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#trusted-access-based-on-a-managed-identity",
1630-
"redirect_url": "/azure/storage/common/storage-network-security-manage-exceptions#trusted-access-based-on-a-managed-identity",
1631-
"redirect_document_id": false
1632-
},
1633-
{
1634-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#trusted-access-based-on-system-assigned-managed-identity",
1635-
"redirect_url": "/azure/storage/common/storage-network-security-manage-exceptions#trusted-access-based-on-system-assigned-managed-identity",
1636-
"redirect_document_id": false
1637-
},
1638-
{
1639-
"source_path_from_root": "/articles/storage/common/storage-network-security.md#azure-storage-cross-region-service-endpoints",
1640-
"redirect_url": "/azure/storage/common/storage-network-security-virtual-networks#azure-storage-cross-region-service-endpoints",
1641-
"redirect_document_id": false
1642-
},
16431578
{
16441579
"source_path_from_root": "/articles/storage/storage-analytics.md",
16451580
"redirect_url": "/azure/storage/common/storage-analytics",

‎articles/storage/blobs/TOC.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -302,11 +302,11 @@ items:
302302
- name: Networking
303303
items:
304304
- name: Network security overview
305-
href: ../common/storage-network-security.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
305+
href: ../common/storage-network-security-overview.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
306306
- name: Manage public access
307307
items:
308-
- name: Manage public access
309-
href: ../common/storage-network-security-public-access-configuration.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
308+
- name: Manage public network access
309+
href: ../common/storage-network-security.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
310310
- name: Set the default access level
311311
href: ../common/storage-network-security-set-default-access.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
312312
- name: Permit virtual networks

‎articles/storage/common/storage-network-security-ip-address-range.md

Lines changed: 36 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Grant Access to Azure Storage from IP Address Ranges
2+
title: Configure Azure Storage to accept requests from IP address ranges
33
description: Configure the Azure Storage firewall to accept requests from IP address ranges.
44
services: storage
55
author: normesta
@@ -10,91 +10,106 @@ ms.date: 06/18/2025
1010
ms.author: normesta
1111
---
1212

13-
# Grant access to Azure Storage from IP address ranges
13+
# Configure the Azure Storage firewall to accept requests from IP address ranges
1414

15-
Put something here.
15+
You can deny all public access to your storage account, and then configure Azure network settings to accept requests from specific IP address ranges. To learn more, see [Permit access to IP address ranges](storage-network-security-public-access-configuration.md#grant-access-from-an-internet-ip-range).
1616

17-
### Managing IP network rules
18-
19-
You can manage IP network rules for storage accounts through the Azure portal, PowerShell, or the Azure CLI v2.
20-
21-
#### [Portal](#tab/azure-portal)
17+
## [Portal](#tab/azure-portal)
2218

2319
1. Go to the storage account for which you want to manage IP network rules.
2420

2521
2. In the service menu, under **Security + networking**, select **Networking**.
2622

27-
3. Check that you've chosen to enable public network access from selected virtual networks and IP addresses.
23+
3. To allow traffic from IP address ranges, make sure that **Enabled from selected virtual networks and IP addresses** is selected.
2824

2925
4. To grant access to an internet IP range, enter the IP address or address range (in CIDR format) under **Firewall** > **Address Range**.
3026

3127
5. To remove an IP network rule, select the delete icon (:::image type="icon" source="media/storage-network-security/delete-icon.png":::) next to the address range.
3228

3329
6. Select **Save** to apply your changes.
3430

35-
#### [PowerShell](#tab/azure-powershell)
31+
## [PowerShell](#tab/azure-powershell)
3632

3733
1. Install [Azure PowerShell](/powershell/azure/install-azure-powershell) and [sign in](/powershell/azure/authenticate-azureps).
3834

39-
2. List IP network rules:
35+
2. To allow traffic to IP address ranges, use the `Update-AzStorageAccountNetworkRuleSet` command and set the `-DefaultAction` parameter to `Deny`:
36+
37+
```powershell
38+
Update-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -DefaultAction Deny
39+
```
40+
41+
> [!IMPORTANT]
42+
> Network rules have no effect unless you set the `-DefaultAction` parameter to `Deny`. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting.
43+
44+
3. List IP network rules:
4045

4146
```powershell
4247
(Get-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount").IPRules
4348
```
4449
45-
3. Add a network rule for an individual IP address:
50+
4. Add a network rule for an individual IP address:
4651
4752
```powershell
4853
Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19"
4954
```
5055
51-
4. Add a network rule for an IP address range:
56+
5. Add a network rule for an IP address range:
5257
5358
```powershell
5459
Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24"
5560
```
5661
57-
5. Remove a network rule for an individual IP address:
62+
6. Remove a network rule for an individual IP address:
5863
5964
```powershell
6065
Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19"
6166
```
6267
63-
6. Remove a network rule for an IP address range:
68+
7. Remove a network rule for an IP address range:
6469
6570
```powershell
6671
Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24"
6772
```
6873
69-
#### [Azure CLI](#tab/azure-cli)
74+
## [Azure CLI](#tab/azure-cli)
7075
7176
1. Install the [Azure CLI](/cli/azure/install-azure-cli) and [sign in](/cli/azure/authenticate-azure-cli).
7277
73-
1. List IP network rules:
78+
79+
2. To allow traffic from IP address ranges, use the `az storage account update` command and set the `--default-action` parameter to `Deny`:
80+
81+
```azurecli
82+
az storage account update --resource-group "myresourcegroup" --name "mystorageaccount" --default-action Deny
83+
```
84+
85+
> [!IMPORTANT]
86+
> Network rules have no effect unless you set the `--default-action` parameter to `Deny`. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting.
87+
88+
3. List IP network rules:
7489

7590
```azurecli
7691
az storage account network-rule list --resource-group "myresourcegroup" --account-name "mystorageaccount" --query ipRules
7792
```
7893
79-
1. Add a network rule for an individual IP address:
94+
4. Add a network rule for an individual IP address:
8095
8196
```azurecli
8297
az storage account network-rule add --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.19"
8398
```
8499
85-
1. Add a network rule for an IP address range:
100+
5. Add a network rule for an IP address range:
86101
87102
```azurecli
88103
az storage account network-rule add --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.0/24"
89104
```
90105
91-
1. Remove a network rule for an individual IP address:
106+
6. Remove a network rule for an individual IP address:
92107
93108
```azurecli
94109
az storage account network-rule remove --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.19"
95110
```
96111
97-
1. Remove a network rule for an IP address range:
112+
7. Remove a network rule for an IP address range:
98113
99114
```azurecli
100115
az storage account network-rule remove --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.0/24"

0 commit comments

Comments
 (0)