Create a separate private endpoint for the secondary instance of the storage service

Pasquini, Matteo (Admin) 45

Hello,

in this doc: https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json
I can read the TIP "Create a separate private endpoint for the secondary instance of the storage service for better read performance on RA-GRS accounts. Make sure to create a general-purpose v2(Standard or Premium) storage account."

Cause geo-replica the secondary resource is not visible (like happen KeyVault).
How identify the secondary resource so that I can create the pep?
or

How identify the secondary resource to attach to a NIC and attach to the pep?

Thanks

Hari Babu Vattepally 1,195 Reputation points Microsoft Vendor

2024-12-12T13:40:44.9833333+00:00

Hi @Pasquini, Matteo (Admin)

Welcome to Microsoft Q&A Forum. Thanks for posting you query here!

You cannot identify the secondary resource directly which is not straight forward, as the secondary instance is not visible like other resources (e.g., Key vault). The secondary instance is managed by Azure and is automatically created as part of geo-replication process. However, you can still create a separate private endpoint for the secondary instance of the storage service for better read performance on RA-GRS accounts.

Secondary replica is not a separate storage account, which means you cannot directly interact with it like a separate resource. For RA-GRS, the secondary replica is only accessible for read operations, and by default, Azure Storage automatically directs read operations to the secondary if needed. To create a separate private endpoint for the secondary instance of the storage service, you need to ensure that you have a general-purpose v2 (Standard or Premium) storage account configured for geo-redundant storage (GRS) or read-access geo-redundant storage (RA-GRS).

For read access to the secondary region, you should create separate private endpoints for both the primary and secondary instances of the service.

You can attach the private endpoint to a network interface (NIC) in the same way you would for the primary instance, but you must ensure that your network configuration allows for proper routing and DNS resolution to the secondary instance.

I hope this helps! Let me know in the comments if you have further questions. Comment is the fastest way to reach the experts for any questions or help you need.

Please do consider to upvote the comment wherever the information provided helps you, this can be beneficial to other community members for remediation for similar issues.
Pasquini, Matteo (Admin) 45 Reputation points

2024-12-12T13:55:33.1666667+00:00

Hello,
All what is answered is correct but not solve the question.

Private endpoint creates NIC as readonly, there is no way to then attach to a pep.
Anyhow would possible to get the ip address form the NIC to set the PrivareDNSZone privatelink ans solve the resource endpoint resolution.

How Identify the NIC for the secondary resource?

Please, avoid AI that, apparently, it is not able to solve the problem.

Thanks.

1 answer

Hari Babu Vattepally 1,195 Reputation points Microsoft Vendor

2024-12-16T18:24:11.3633333+00:00
Hi @Pasquini, Matteo (Admin)

Apologize for delay in response and for any inconvenience caused.

Yes, you are correct that when you create a Private Endpoint, it creates a NIC as read-only and it cannot be attached to Private Endpoint.

By following the below steps, you can identify the NIC of secondary resources.

Identify the secondary resource.

Locate the private endpoint associated with that resource.

Use Azure CLI or PowerShell to list the NICs and their IP addresses.

For example, using Azure CLI:-

az network private-endpoint list --resource-group <ResourceGroupName> --query "[].{Name:name, NicId:nic.id, IpAddress:ipAddress}"

And then, update your Private DNS Zone with the correct IP address. Once you have the IP address, you can update the Private DNS Zone with the new A record pointing to the NIC IP address.

For more additional information, please refer the below links.

cross-tenant-secure-access-private-endpoints.

private-endpoint-overview.

I hope this helps and addressed your query. Please let us know if the issue is resolved or still persist. We will be glad to assist you closely.

Thanks!
Please sign in to rate this answer.
Hari Babu Vattepally 1,195 Reputation points Microsoft Vendor

2024-12-17T12:19:18.69+00:00

@Pasquini, Matteo (Admin)

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Hari Babu Vattepally 1,195 Reputation points Microsoft Vendor

2024-12-18T07:17:05.72+00:00

Hi @Pasquini, Matteo (Admin)

Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Create a separate private endpoint for the secondary instance of the storage service

1 answer

Your answer