|
| 1 | +--- |
| 2 | +title: Create an IP network rule for Azure Storage |
| 3 | +description: Learn how to create an IP network rule that enables traffic to an Azure Storage account from IP address ranges. |
| 4 | +services: storage |
| 5 | +author: normesta |
| 6 | +ms.service: azure-storage |
| 7 | +ms.subservice: storage-common-concepts |
| 8 | +ms.topic: how-to |
| 9 | +ms.date: 06/18/2025 |
| 10 | +ms.author: normesta |
| 11 | +--- |
| 12 | + |
| 13 | +# Create an IP network rule for Azure Storage |
| 14 | + |
| 15 | +You can deny all public access to your storage account and then configure Azure network settings to accept requests from specific IP address ranges. To enable traffic from specific public IP address ranges, create one or more IP network rules. To learn more, see [Permit access to IP address ranges](storage-network-security.md#grant-access-from-an-internet-ip-range). |
| 16 | + |
| 17 | +## Create an IP network rule |
| 18 | + |
| 19 | +### [Portal](#tab/azure-portal) |
| 20 | + |
| 21 | +1. Go to the storage account for which you want to manage IP network rules. |
| 22 | + |
| 23 | +2. In the service menu, under **Security + networking**, select **Networking**. |
| 24 | + |
| 25 | +3. To allow traffic from IP address ranges, make sure that **Enabled from selected virtual networks and IP addresses** is selected. |
| 26 | + |
| 27 | +4. To grant access to an internet IP range, enter the IP address or address range (in CIDR format) under **Firewall** > **Address Range**. |
| 28 | + |
| 29 | +5. To remove an IP network rule, select the delete icon (:::image type="icon" source="media/storage-network-security/delete-icon.png":::) next to the address range. |
| 30 | + |
| 31 | +6. Select **Save** to apply your changes. |
| 32 | + |
| 33 | +### [PowerShell](#tab/azure-powershell) |
| 34 | + |
| 35 | +1. Install [Azure PowerShell](/powershell/azure/install-azure-powershell) and [sign in](/powershell/azure/authenticate-azureps). |
| 36 | + |
| 37 | +2. To allow traffic from IP address ranges, use the `Update-AzStorageAccountNetworkRuleSet` command and set the `-DefaultAction` parameter to `Deny`: |
| 38 | + |
| 39 | + ```powershell |
| 40 | + Update-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -DefaultAction Deny |
| 41 | + ``` |
| 42 | + |
| 43 | + > [!IMPORTANT] |
| 44 | + > Network rules have no effect unless you set the `-DefaultAction` parameter to `Deny`. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting. |
| 45 | +
|
| 46 | +3. List IP network rules: |
| 47 | + |
| 48 | + ```powershell |
| 49 | + (Get-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount").IPRules |
| 50 | + ``` |
| 51 | +
|
| 52 | +4. Add a network rule for an individual IP address: |
| 53 | +
|
| 54 | + ```powershell |
| 55 | + Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19" |
| 56 | + ``` |
| 57 | +
|
| 58 | +5. Add a network rule for an IP address range: |
| 59 | +
|
| 60 | + ```powershell |
| 61 | + Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24" |
| 62 | + ``` |
| 63 | +
|
| 64 | +6. Remove a network rule for an individual IP address: |
| 65 | +
|
| 66 | + ```powershell |
| 67 | + Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19" |
| 68 | + ``` |
| 69 | +
|
| 70 | +7. Remove a network rule for an IP address range: |
| 71 | +
|
| 72 | + ```powershell |
| 73 | + Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24" |
| 74 | + ``` |
| 75 | +
|
| 76 | +### [Azure CLI](#tab/azure-cli) |
| 77 | +
|
| 78 | +1. Install the [Azure CLI](/cli/azure/install-azure-cli) and [sign in](/cli/azure/authenticate-azure-cli). |
| 79 | +
|
| 80 | +2. To allow traffic from IP address ranges, use the `az storage account update` command and set the `--default-action` parameter to `Deny`: |
| 81 | +
|
| 82 | + ```azurecli |
| 83 | + az storage account update --resource-group "myresourcegroup" --name "mystorageaccount" --default-action Deny |
| 84 | + ``` |
| 85 | + |
| 86 | + > [!IMPORTANT] |
| 87 | + > Network rules have no effect unless you set the `--default-action` parameter to `Deny`. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting. |
| 88 | +
|
| 89 | +3. List IP network rules: |
| 90 | + |
| 91 | + ```azurecli |
| 92 | + az storage account network-rule list --resource-group "myresourcegroup" --account-name "mystorageaccount" --query ipRules |
| 93 | + ``` |
| 94 | +
|
| 95 | +4. Add a network rule for an individual IP address: |
| 96 | +
|
| 97 | + ```azurecli |
| 98 | + az storage account network-rule add --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.19" |
| 99 | + ``` |
| 100 | +
|
| 101 | +5. Add a network rule for an IP address range: |
| 102 | +
|
| 103 | + ```azurecli |
| 104 | + az storage account network-rule add --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.0/24" |
| 105 | + ``` |
| 106 | +
|
| 107 | +6. Remove a network rule for an individual IP address: |
| 108 | +
|
| 109 | + ```azurecli |
| 110 | + az storage account network-rule remove --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.19" |
| 111 | + ``` |
| 112 | +
|
| 113 | +7. Remove a network rule for an IP address range: |
| 114 | +
|
| 115 | + ```azurecli |
| 116 | + az storage account network-rule remove --resource-group "myresourcegroup" --account-name "mystorageaccount" --ip-address "16.17.18.0/24" |
| 117 | + ``` |
| 118 | +
|
| 119 | +--- |
| 120 | +
|
| 121 | +## See also |
| 122 | +
|
| 123 | +- [Azure Storage firewall and virtual network rules](storage-network-security.md) |
0 commit comments