Some revisions

normesta · normesta · commit 4a8c2fa3ceae · 2025-06-24T09:44:15.000-07:00
diff --git a/articles/storage/blobs/TOC.yml b/articles/storage/blobs/TOC.yml
@@ -321,6 +321,8 @@ items:
             href: ../common/storage-network-security-resource-instances.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
           - name: Manage Exceptions
             href: ../common/storage-network-security-manage-exceptions.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
+          - name: Trusted Azure services
+            href: ../common/storage-network-security-trusted-microsoft-services.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
         - name: Network security perimeter
           href: ../common/storage-network-security-perimeter.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
       - name: Private endpoints
diff --git a/articles/storage/common/storage-network-security-ip-address-range.md b/articles/storage/common/storage-network-security-ip-address-range.md
@@ -1,6 +1,6 @@
 ---
-title: Configure Azure Storage to accept requests from IP address ranges
-description: Configure the Azure Storage firewall to accept requests from IP address ranges.
+title: Create an IP network rule for Azure Storage
+description: Learn how to create an IP network rule that enables traffic to an Azure Storage account from IP address ranges.
 services: storage
 author: normesta
 ms.service: azure-storage
@@ -10,11 +10,13 @@ ms.date: 06/18/2025
 ms.author: normesta
 ---
 
-# Configure the Azure Storage firewall to accept requests from IP address ranges
+# Create an IP network rule for Azure Storage
 
-You can deny all public access to your storage account, and then configure Azure network settings to accept requests from specific IP address ranges. To learn more, see [Permit access to IP address ranges](storage-network-security.md#grant-access-from-an-internet-ip-range).
+You can deny all public access to your storage account, and then configure Azure network settings to accept requests from specific IP address ranges. To enable traffic from a specific public IP address ranges, create one or more IP network rules. To learn more, see [Permit access to IP address ranges](storage-network-security.md#grant-access-from-an-internet-ip-range).
 
-## [Portal](#tab/azure-portal)
+## Create an IP network rule
+
+### [Portal](#tab/azure-portal)
 
 1. Go to the storage account for which you want to manage IP network rules.
 
@@ -28,7 +30,7 @@ You can deny all public access to your storage account, and then configure Azure
 
 6. Select **Save** to apply your changes.
 
-## [PowerShell](#tab/azure-powershell)
+### [PowerShell](#tab/azure-powershell)
 
 1. Install [Azure PowerShell](/powershell/azure/install-azure-powershell) and [sign in](/powershell/azure/authenticate-azureps).
 
@@ -71,7 +73,7 @@ You can deny all public access to your storage account, and then configure Azure
     Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24"
     ```
 
-## [Azure CLI](#tab/azure-cli)
+### [Azure CLI](#tab/azure-cli)
 
 1. Install the [Azure CLI](/cli/azure/install-azure-cli) and [sign in](/cli/azure/authenticate-azure-cli).
 
diff --git a/articles/storage/common/storage-network-security-virtual-networks.md b/articles/storage/common/storage-network-security-virtual-networks.md
@@ -1,6 +1,6 @@
 ---
-title: Configure Azure Storage to accept requests from virtual networks
-description: Learn how to configure Azure Storage to accept requests from virtual networks.
+title: Create a virtual network rule for Azure Storage
+description: Learn how to create a virtual network rule that enables traffic to an Azure Storage account from subnets in an Azure Virtual network.
 services: storage
 author: normesta
 ms.service: azure-storage
@@ -11,13 +11,15 @@ ms.author: normesta
 
 ---
 
-# Configure Azure Storage to accept requests from virtual networks
+# Create a virtual network rule for Azure Storage
 
-You can deny all public access to your storage account, and then configure Azure network settings to accept requests that originate from specific virtual network subnets. To learn more, see [Permit access to virtual network subnets](storage-network-security.md#grant-access-from-a-virtual-network).
+You can deny all public access to your storage account, and then configure Azure network settings to accept requests that originate from specific virtual network subnets. To learn more, see [virtual network subnets](storage-network-security.md#grant-access-from-a-virtual-network).
 
 To apply a virtual network rule to a storage account, the user must have the appropriate permissions for the subnets that are being added. A [Storage Account Contributor](../../role-based-access-control/built-in-roles.md#storage-account-contributor) or a user who has permission to the `Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action` [Azure resource provider operation](../../role-based-access-control/resource-provider-operations.md#microsoftnetwork) can apply a rule by using a custom Azure role.
 
-## [Portal](#tab/azure-portal)
+## Create a virtual network rule
+
+### [Portal](#tab/azure-portal)
 
 > [!NOTE]
 > If you want to enable access from a virtual network in another Microsoft Entra tenant, you must use PowerShell or the Azure CLI. The Azure portal doesn't show subnets in other Microsoft Entra tenants.
@@ -26,9 +28,19 @@ To apply a virtual network rule to a storage account, the user must have the app
 
 2. In the service menu, under **Security + networking**, select **Networking**.
 
-3. To allow traffic only from specific virtual networks, make sure that **Enabled from selected virtual networks and IP addresses** is selected.  
+3. In the **Firewalls and virtual networks** tab of the network settings page, make sure that **Enabled from selected virtual networks and IP addresses** is selected.  
+
+4. Under **Virtual networks**, select **Add existing virtual network**. 
+
+   The **Add networks pane** appears.
+
+5. From the **Virtual networks** drop-down list, select a virtual network. 
+
+6. From the **Subnets** drop-down list, select the desired subnets, then select **Add**. 
+
+6. If you need to create a new virtual network, select **Add new virtual network**. Provide the necessary information to create the new virtual network, and then select **Create**. 
 
-4. To grant access to a virtual network by using a new network rule, under **Virtual networks**, select **Add existing virtual network**. Select the **Virtual networks** and **Subnets** options, and then select **Add**. To create a new virtual network and grant it access, select **Add new virtual network**. Provide the necessary information to create the new virtual network, and then select **Create**. Currently, only virtual networks that belong to the same Microsoft Entra tenant appear for selection during rule creation. To grant access to a subnet in a virtual network that belongs to another tenant, use PowerShell, the Azure CLI, or REST API.
+   Only virtual networks that belong to the same Microsoft Entra tenant appear for selection during rule creation. To grant access to a subnet in a virtual network that belongs to another tenant, use PowerShell, the Azure CLI, or REST API.
 
 5. To remove a virtual network or subnet rule, select the ellipsis (**...**) to open the context menu for the virtual network or subnet, and then select **Remove**.
 
@@ -37,7 +49,7 @@ To apply a virtual network rule to a storage account, the user must have the app
 > [!IMPORTANT]
 > If you delete a subnet that's included in a network rule, it will be removed from the network rules for the storage account. If you create a new subnet by the same name, it won't have access to the storage account. To allow access, you must explicitly authorize the new subnet in the network rules for the storage account.
 
-## [PowerShell](#tab/azure-powershell)
+### [PowerShell](#tab/azure-powershell)
 
 1. Install [Azure PowerShell](/powershell/azure/install-azure-powershell) and [sign in](/powershell/azure/authenticate-azureps).
 
@@ -78,7 +90,7 @@ To apply a virtual network rule to a storage account, the user must have the app
     Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -VirtualNetworkResourceId $subnet.Id
     ```
 
-## [Azure CLI](#tab/azure-cli)
+### [Azure CLI](#tab/azure-cli)
 
 1. Install the [Azure CLI](/cli/azure/install-azure-cli) and [sign in](/cli/azure/authenticate-azure-cli).
 
diff --git a/articles/storage/common/storage-network-security.md b/articles/storage/common/storage-network-security.md
@@ -34,7 +34,7 @@ The following table describes each type of service endpoint that you can enable
 > [!NOTE]
 > You can associate only one of these endpoint types to a subnet. If one of these endpoints is already associated with the subnet, you'll have to delete that endpoint before adding the other. 
 
-To learn how to configure a virtual network rule and enable service endpoints, see [Configure Azure Storage to accept requests from virtual networks](storage-network-security-virtual-networks.md).
+To learn how to configure a virtual network rule and enable service endpoints, see [Create a virtual network rule for Azure Storage](storage-network-security-virtual-networks.md).
 
 <a id="grant-access-from-an-internet-ip-range"></a>
 <a id="managing-ip-network-rules"></a>
@@ -51,7 +51,7 @@ When you're planning for disaster recovery during a regional outage, create the
 
 For clients and services not located in a virtual network, you can enable traffic by creating *IP network rules*. Each IP network rule can enable traffic from a specific public IP address range. For example, if a client from an on-premises network needs to access storage data, then a rule can include the public IP address of that client. Each storage account supports up to **400** IP network rules. 
 
-To learn how to create IP network rules, see [Configure the Azure Storage firewall to accept requests from IP address ranges](storage-network-security-ip-address-range.md).
+To learn how to create IP network rules, see [Create an IP network rule for Azure Storage](storage-network-security-ip-address-range.md).
 
 If you've enabled a service endpoint for a subnet, then traffic from that subnet won't use a public IP address to communicate with a storage account. Instead, all the traffic uses a private IP address as a source IP. As a result, IP network rules that permit traffic from those subnets no longer have an effect.
 
@@ -82,6 +82,7 @@ To learn how to configure a resource instance rule, see [Configure Azure Storage
 <a id="exceptions"></a>
 <a id="trusted-access-based-on-system-assigned-managed-identity"></a>
 <a id="trusted-access-based-on-a-managed-identity"></a>
+<a id="trusted-access-for-resources-registered-in-your-microsoft-entra-tenant"></a>
 
 ## Trusted Azure services
 
