Merge pull request #142896 from DavidTrigano/patch-21

Update sql-database-vulnerability-assessment-storage.md

Author: PMEds28

articles/azure-sql/database/sql-database-vulnerability-assessment-storage.md

@@ -5,8 +5,8 @@ services: sql-database
 ms.service: sql-db-mi
 ms.subservice: security
 ms.topic: how-to
-author: barmichal
-ms.author: mibar
+author: davidtrigano
+ms.author: datrigan
 ms.reviewer: vanto
 ms.date: 12/01/2020
 ---
@@ -18,18 +18,21 @@ If you are limiting access to your storage account in Azure for certain VNets or
 
 ## Enable Azure SQL Database VA scanning access to the storage account
 
-If you have configured your VA storage account to only be accessible by certain networks or services, you'll need to ensure that VA scans for your Azure SQL Database are able to store the scans on the storage account. To find out which storage account is being used, go to your **SQL server** pane in the [Azure portal](https://portal.azure.com), under **Security**, select **Security Center**.
+If you have configured your VA storage account to only be accessible by certain networks or services, you'll need to ensure that VA scans for your Azure SQL Database are able to store the scans on the storage account. You can use the existing storage account, or create a new storage account to store VA scan results for all databases on your [logical SQL server](logical-servers.md).
 
-:::image type="content" source="../database/media/azure-defender-for-sql/va-storage.png" alt-text="set up vulnerability assessment":::
-
-You can use the existing storage account, or create a new storage account to store VA scan results for all databases on your [logical SQL server](logical-servers.md).
+> [!NOTE]
+> The vulnerability assessment service can't access storage accounts protected with firewalls or VNets if they require storage access keys.
 
 Go to your **Resource group** that contains the storage account and access the **Storage account** pane. Under **Settings**, select **Firewall and virtual networks**.
 
 Ensure that **Allow trusted Microsoft services access to this storage account** is checked.
 
 :::image type="content" source="media/sql-database-vulnerability-assessment-storage/storage-allow-microsoft-services.png" alt-text="Screenshot shows Firewall and virtual networks dialog box, with Allow trusted Microsoft services to access this storage account selected.":::
 
+To find out which storage account is being used, go to your **SQL server** pane in the [Azure portal](https://portal.azure.com), under **Security**, select **Security Center**.
+
+:::image type="content" source="../database/media/azure-defender-for-sql/va-storage.png" alt-text="set up vulnerability assessment":::
+
 ## Store VA scan results for Azure SQL Managed Instance in a storage account that can be accessed behind a firewall or VNet
 
 Since Managed Instance is not a trusted Microsoft Service and has a different VNet from the storage account, executing a VA scan will result in an error.
@@ -58,4 +61,4 @@ You should now be able to store your VA scans for Managed Instances in your stor
 
 - [Vulnerability Assessment](sql-vulnerability-assessment.md)
 - [Create an Azure Storage account](../../storage/common/storage-account-create.md)
-- [Azure Defender for SQL](azure-defender-for-sql.md)
+- [Azure Defender for SQL](azure-defender-for-sql.md)