Storage Account > Network when public access is disabled

Question

Hi

I have disabled the Storage Account i.e. Public network access to Disabled

However it still allows me to make successful Queue - Get call from internet (GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}?api-version=2023-12-01)

Is there any change in this behaviour in Azure Storage account?

Can we make get call to storage queue when the public network is disabled in the parent Storage Account?

Answer 1

Hello Raj,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to know what caused the issue you are having when you disable public network access for an Azure Storage Account, it should block incoming requests from the internet by default but not.

Understand that disabling public network access restricts external requests, but private endpoints and proper authorization mechanisms still allow controlled access to your storage account. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security

To block all public access to Azure Storage Accounts: https://harvestingclouds.com/post/block-all-public-access-to-azure-storage-accounts-via-manual-setting/

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam

Answer 2

Hello Raj,

Greetings! Welcome to Microsoft Q&A Platform.

I understand that you’re experiencing an unexpected behavior with your Azure Storage account. When you disable public network access, it should block all traffic from the internet, allowing access only through private endpoints or specified virtual networks. Please consider checking below following to troubleshoot the issue,

• Make sure you disabled the public network access in Network configuration section and also enabled the Deny Public Network option. Double-check your firewall settings to ensure they are correctly configured to block all public access. refer https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal, https://techcommunity.microsoft.com/t5/azure-paas-blog/troubleshooting-storage-firewall-issues/ba-p/1944730
• Azure allows certain trusted services to bypass network rules. Ensure that no exceptions are configured that might allow access. Refer - https://techcommunity.microsoft.com/t5/azure-paas-blog/public-access-is-not-permitted-on-this-storage-account/ba-p/3521288
• Even with network rules in place, proper authorization (like SAS tokens or account keys) is still required. Check if any authorization methods are inadvertently allowing access.
• Enable and review storage diagnostics logs to identify any anomalies or specific IP addresses that might be accessing the storage account.

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.