Skip to content

Commit d0f5c1a

Browse files
Merge pull request #301546 from normesta/network-content-improvement
Network Security Content Overhaul
2 parents 361f42c + da5fabf commit d0f5c1a

20 files changed

+1012
-744
lines changed

articles/api-management/api-management-howto-use-managed-service-identity.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,7 @@ API Management is a trusted Microsoft service to the following resources. This t
317317

318318

319319
- [Trusted access for Key Vault](/azure/key-vault/general/overview-vnet-service-endpoints#trusted-services)
320-
- [Trusted access for Azure Storage](../storage/common/storage-network-security.md?tabs=azure-portal#trusted-access-based-on-system-assigned-managed-identity)
320+
- [Trusted access for Azure Storage](../storage/common/storage-network-security-trusted-azure-services.md?tabs=azure-portal#trusted-access-based-on-system-assigned-managed-identity)
321321
- [Trusted access for Azure Services Bus](../service-bus-messaging/service-bus-ip-filtering.md#trusted-microsoft-services)
322322
- [Trusted access for Azure Event Hubs](../event-hubs/event-hubs-ip-filtering.md#trusted-microsoft-services)
323323

articles/azure-functions/functions-infrastructure-as-code.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2020,7 +2020,7 @@ You might also need to use these settings when your function app has network res
20202020
::: zone pivot="flex-consumption-plan,premium-plan,dedicated-plan"
20212021
### Considerations for network restrictions
20222022

2023-
When you're restricting access to the storage account through the private endpoints, you aren't able to access the storage account through the portal or any device outside the virtual network. You can give access to your secured IP address or virtual network in the storage account by [Managing the default network access rule](../storage/common/storage-network-security.md#change-the-default-network-access-rule).
2023+
When you're restricting access to the storage account through the private endpoints, you aren't able to access the storage account through the portal or any device outside the virtual network. You can give access to your secured IP address or virtual network in the storage account by [Managing the default network access rule](../storage/common/storage-network-security-set-default-access.md).
20242024
::: zone-end
20252025
## Function access keys
20262026

articles/cost-management-billing/costs/tutorial-improved-exports.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ A system-assigned managed identity is created for a new job export when created
155155
> - When a user updates destination details or deletes an export, the *StorageBlobDataContributor* role assigned to the managed identity is automatically removed. To enable the system to remove the role assignment, the user must have `microsoft.Authorization/roleAssignments/delete` permissions. If the permissions aren't available, the user needs to manually remove the role assignment on the managed identity.
156156
> - Currently, firewalls are supported for storage accounts in the same tenant. However, firewalls on storage accounts aren't supported for cross-tenant exports.
157157
158-
Add exports to the list of trusted services. For more information, see [Trusted access based on a managed identity](../../storage/common/storage-network-security.md#trusted-access-based-on-a-managed-identity).
158+
Add exports to the list of trusted services. For more information, see [Trusted access based on a managed identity](../../storage/common/storage-network-security-trusted-azure-services.md#trusted-access-based-on-a-managed-identity).
159159

160160
## Manage exports
161161

articles/data-factory/data-access-strategies.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,5 +95,5 @@ For more information about supported network security mechanisms on data stores
9595
For more information, see the following related articles:
9696
* [Supported data stores](./copy-activity-overview.md#supported-data-stores-and-formats)
9797
* [Azure Key Vault ‘Trusted Services’](/azure/key-vault/general/overview-vnet-service-endpoints#trusted-services)
98-
* [Azure Storage ‘Trusted Microsoft Services’](../storage/common/storage-network-security.md#trusted-microsoft-services)
98+
* [Azure Storage ‘Trusted Microsoft Services’](../storage/common/storage-network-security-trusted-azure-services.md#trusted-microsoft-services)
9999
* [Managed identity for Data Factory](./data-factory-service-identity.md)

articles/data-share/security.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Once a share is created or received, users with proper permission to the Data Sh
2626

2727
## Share data from or to data stores with firewall enabled
2828

29-
To share data from or to storage accounts with firewall turned on, you need to enable **Allow trusted Microsoft services** in your storage account. See [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security.md#trusted-microsoft-services) for details.
29+
To share data from or to storage accounts with firewall turned on, you need to enable **Allow trusted Microsoft services** in your storage account. See [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security-trusted-azure-services.md#trusted-microsoft-services) for details.
3030

3131
## Related content
3232

articles/remote-rendering/how-tos/create-an-account.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ The value for **`arrAccountKey`** can either be primary or secondary key.
7474

7575
This paragraph explains how to link storage accounts to your Remote Rendering account. With a linked account, it isn't necessary anymore to generate a SAS URI every time you want to interact with the data in your account. Instead, you can use the storage account names directly as described in the [loading a model section](../concepts/models.md#loading-models).
7676

77-
Another advantage of this approach is that the storage access level can be limited to private endpoints as described in the [Azure documentation how to configure Storage firewalls and virtual networks](../../storage/common/storage-network-security.md#change-the-default-network-access-rule). Loading from blob storage through a SAS token on the other hand only works if the blob storage has been configured with the "Enabled from all networks" option.
77+
Another advantage of this approach is that the storage access level can be limited to private endpoints as described in the [Azure documentation how to configure Storage firewalls and virtual networks](../../storage/common/storage-network-security-set-default-access.md). Loading from blob storage through a SAS token on the other hand only works if the blob storage has been configured with the "Enabled from all networks" option.
7878

7979
The steps in this paragraph have to be performed for each storage account that should use this access method. If you haven't created storage accounts yet, you can walk through the respective step in the [convert a model for rendering quickstart](../quickstarts/convert-model.md#storage-account-creation).
8080

articles/remote-rendering/resources/troubleshoot.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Sometimes during [linking of a storage account](../how-tos/create-an-account.md#
2626

2727
## Cannot load model through a SAS token
2828

29-
If the client application fails to load a model from storage through a valid SAS-token, it might be caused by the [public network access level](../../storage/common/storage-network-security.md#change-the-default-network-access-rule) configured on the blob storage. Loading an ARR model from SAS token only works if it has been configured with the "Enabled from all networks" option:
29+
If the client application fails to load a model from storage through a valid SAS-token, it might be caused by the [public network access level](../../storage/common/storage-network-security-set-default-access.md) configured on the blob storage. Loading an ARR model from SAS token only works if it has been configured with the "Enabled from all networks" option:
3030
![Screenshot of Azure portal settings for public network access level on blob storage.](./media/portal-blob-access-restrictions.png)
3131

3232
If limiting to private endpoints is a requirement, the [storage account must be linked](../how-tos/create-an-account.md#link-storage-accounts) and the model must be loaded through the non-SAS code path as [described here](../tutorials/unity/security/security.md#securing-your-content-in-azure-blob-storage).

articles/storage/blobs/TOC.yml

Lines changed: 34 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -301,28 +301,50 @@ items:
301301
href: storage-encrypt-decrypt-blobs-key-vault.md
302302
- name: Networking
303303
items:
304-
- name: Require secure transfer
305-
href: ../common/storage-require-secure-transfer.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
306-
- name: Configure firewalls and virtual networks
307-
href: ../common/storage-network-security.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
308-
- name: Use Azure Private Endpoints
304+
- name: Network security
305+
href: ../common/storage-network-security-overview.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
306+
- name: Private endpoints
309307
href: ../common/storage-private-endpoints.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
310-
- name: Restrict scope of copy operations
311-
href: ../common/security-restrict-copy-operations.md?toc=/azure/storage/blobs/toc.json
312-
- name: Manage Transport Layer Security (TLS)
308+
- name: Public endpoint
309+
items:
310+
- name: Default access level
311+
href: ../common/storage-network-security-set-default-access.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
312+
- name: Firewall rules
313+
items:
314+
- name: Firewall rules
315+
href: ../common/storage-network-security.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
316+
- name: Guidelines and limitations
317+
href: ../common/storage-network-security-limitations.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
318+
- name: Virtual network rules
319+
href: ../common/storage-network-security-virtual-networks.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
320+
- name: IP network rules
321+
href: ../common/storage-network-security-ip-address-range.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
322+
- name: Resource instance rules
323+
href: ../common/storage-network-security-resource-instances.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
324+
- name: Network rule exceptions
325+
href: ../common/storage-network-security-manage-exceptions.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
326+
- name: Trusted Azure services
327+
href: ../common/storage-network-security-trusted-azure-services.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
328+
- name: Network security perimeter
329+
href: ../common/storage-network-security-perimeter.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
330+
- name: Transport Layer Security
313331
items:
314-
- name: Enforce minimum TLS version for incoming requests
332+
- name: Require secure transfer
333+
href: ../common/storage-require-secure-transfer.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
334+
- name: Enforce minimum TLS version
315335
href: ../common/transport-layer-security-configure-minimum-version.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
316-
- name: Configure TLS version for a client application
336+
- name: Configure TLS version for a client
317337
href: ../common/transport-layer-security-configure-client-version.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
318338
- name: Migrate to TLS 1.2
319339
href: ../common/transport-layer-security-configure-migrate-to-TLS2.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
320-
- name: Network routing preference
340+
- name: Network routing
321341
href: ../common/network-routing-preference.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
322342
items:
323343
- name: Configure network routing preference
324344
href: ../common/configure-network-routing-preference.md?toc=/azure/storage/blobs/toc.json
325-
- name: Use a custom domain
345+
- name: Copy operation scopes
346+
href: ../common/security-restrict-copy-operations.md?toc=/azure/storage/blobs/toc.json
347+
- name: Custom domains
326348
href: storage-custom-domain-name.md
327349
- name: Authorization
328350
items:
Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
---
2+
title: Create an IP network rule for Azure Storage
3+
description: Learn how to create an IP network rule that enables traffic to an Azure Storage account from IP address ranges.
4+
services: storage
5+
author: normesta
6+
ms.service: azure-storage
7+
ms.subservice: storage-common-concepts
8+
ms.topic: how-to
9+
ms.date: 06/18/2025
10+
ms.author: normesta
11+
---
12+
13+
# Create an IP network rule for Azure Storage
14+
15+
You can deny all public access to your storage account and then configure Azure network settings to accept requests from specific IP address ranges. To enable traffic from specific public IP address ranges, create one or more IP network rules. To learn more, see [Permit access to IP address ranges](storage-network-security.md#grant-access-from-an-internet-ip-range).
16+
17+
## Create an IP network rule
18+
19+
### [Portal](#tab/azure-portal)
20+
21+
1. Go to the storage account for which you want to manage IP network rules.
22+
23+
2. In the service menu, under **Security + networking**, select **Networking**.
24+
25+
3. To allow traffic from IP address ranges, make sure that **Enabled from selected virtual networks and IP addresses** is selected.
26+
27+
4. To grant access to an internet IP range, enter the IP address or address range (in CIDR format) under **Firewall** > **Address Range**.
28+
29+
5. To remove an IP network rule, select the delete icon (:::image type="icon" source="media/storage-network-security/delete-icon.png":::) next to the address range.
30+
31+
6. Select **Save** to apply your changes.
32+
33+
### [PowerShell](#tab/azure-powershell)
34+
35+
1. Install [Azure PowerShell](/powershell/azure/install-azure-powershell) and [sign in](/powershell/azure/authenticate-azureps).
36+
37+
2. To allow traffic from IP address ranges, use the `Update-AzStorageAccountNetworkRuleSet` command and set the `-DefaultAction` parameter to `Deny`:
38+
39+
```powershell
40+
Update-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -DefaultAction Deny
41+
```
42+
43+
> [!IMPORTANT]
44+
> Network rules have no effect unless you set the `-DefaultAction` parameter to `Deny`. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting.
45+
46+
3. List IP network rules:
47+
48+
```powershell
49+
(Get-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount").IPRules
50+
```
51+
52+
4. Add a network rule for an individual IP address:
53+
54+
```powershell
55+
Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19"
56+
```
57+
58+
5. Add a network rule for an IP address range:
59+
60+
```powershell
61+
Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24"
62+
```
63+
64+
6. Remove a network rule for an individual IP address:
65+
66+
```powershell
67+
Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19"
68+
```
69+
70+
7. Remove a network rule for an IP address range:
71+
72+
```powershell
73+
Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24"
74+
```
75+
76+
### [Azure CLI](#tab/azure-cli)
77+
78+
1. Install the [Azure CLI](/cli/azure/install-azure-cli) and [sign in](/cli/azure/authenticate-azure-cli).
79+
80+
2. To allow traffic from IP address ranges, use the `az storage account update` command and set the `--default-action` parameter to `Deny`:
81+
82+
```azurecli
83+
az storage account update --resource-group "myresourcegroup" --name "mystorageaccount" --default-action Deny
84+
```
85+
86+
> [!IMPORTANT]
87+
> Network rules have no effect unless you set the `--default-action` parameter to `Deny`. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting.
88+
89+
3. List IP network rules:
90+
91+
```azurecli
92+
az storage account network-rule list --resource-group "myresourcegroup" --account-name "mystorageaccount" --query ipRules
93+
```
94+
95+
4. Add a network rule for an individual IP address:
96+
97+
```azurecli
98+
az storage account network-rule add --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.19"
99+
```
100+
101+
5. Add a network rule for an IP address range:
102+
103+
```azurecli
104+
az storage account network-rule add --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.0/24"
105+
```
106+
107+
6. Remove a network rule for an individual IP address:
108+
109+
```azurecli
110+
az storage account network-rule remove --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.19"
111+
```
112+
113+
7. Remove a network rule for an IP address range:
114+
115+
```azurecli
116+
az storage account network-rule remove --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.0/24"
117+
```
118+
119+
---
120+
121+
## See also
122+
123+
- [Azure Storage firewall and virtual network rules](storage-network-security.md)

0 commit comments

Comments
 (0)