Edit

Configure network endpoints for Azure file shares

This article explains how to create private endpoints and restrict public endpoint access for Azure file shares. For classic file shares (Microsoft.Storage), you configure the storage account. For file shares created with Microsoft.FileShares, you configure each file share. The classic file share steps also apply to storage accounts that Azure File Sync uses. For Azure File Sync networking requirements, see Configure Azure File Sync proxy and firewall settings.

To choose between private endpoints and network rules, see Azure Files networking considerations.

Prerequisites

Create a private endpoint

When you create a private endpoint for your file shares, you deploy the following Azure resources:

  • A private endpoint: An Azure resource that represents the private endpoint. You can think of this resource as a connector between a target resource and a network interface.
  • A network interface (NIC): The network interface that maintains a private IP address within the specified virtual network and subnet. This resource is the same as the one you deploy when you deploy a virtual machine (VM). However, instead of assigning it to a VM, the private endpoint owns it.
  • A private Domain Name System (DNS) zone: These steps create or reuse an Azure private DNS zone linked to the virtual network and add an A record for the private endpoint. You can use your own DNS infrastructure instead, provided clients resolve the file share's host name to the private endpoint's IP address.

Note

In Azure public cloud, both resource providers use the private DNS zone privatelink.file.core.windows.net. Their client host names differ; see Verify connectivity for examples. For classic file shares in other Azure clouds, use the storage endpoint suffix for that cloud.

The private endpoint creation process differs slightly depending on whether you're using classic file shares or Microsoft.FileShares. For classic file shares, you create a private endpoint for the storage account that contains the file shares. For file shares created with Microsoft.FileShares, you create a private endpoint for the file share itself.

Many of the steps are identical for both resource providers. Only the resource reference, group ID, and DNS record name differ, as shown in the following table.

Classic file shares (Microsoft.Storage) File shares (Microsoft.FileShares)
Private endpoint target Storage account File share
Resource cmdlet Get-AzStorageAccount Get-AzFileShare
Group ID (sub-resource) file FileShare
DNS A record name Storage account name Host name prefix (for example, fs-xxxxxxxxxxxxxxxxx)

Go to the resource group where you want to create a private endpoint. Select + Create and search for Private Endpoint. Select the private endpoint resource, and then select Create.

The wizard has multiple pages to complete.

On the Basics page, select the subscription, resource group, name, network interface name, and region for your private endpoint. The private endpoint must be in the same region as its virtual network. Then select Next: Resource.

Screenshot showing how to provide the project and instance details for a new private endpoint.

On the Resource page, select Microsoft.Storage/storageAccounts from the drop-down menu for Resource type. For Resource, select the specific storage account you want to connect to. For Target sub-resource, select file. Then select Next: Virtual Network.

Screenshot showing how to select the resource type, resource, and target sub-resource for the new private endpoint.

On the Resource page, select Microsoft.FileShares/fileShares from the drop-down menu for Resource type. For Resource, select the specific file share you want to connect to. The target sub-resource auto-populates with FileShare. Then select Next: Virtual Network.

Screenshot showing how to select the Microsoft.FileShares resource type and the file share for the new private endpoint.

The Virtual Network page allows you to select the specific virtual network and subnet you want to add your private endpoint to. Select dynamic or static IP address allocation for the new private endpoint. If you select static, you also need to provide a name and a private IP address. You can also optionally specify an application security group. When you're finished, select Next: DNS.

Screenshot showing how to provide virtual network, subnet, and IP address details for the new private endpoint.

The DNS page contains the information for integrating your private endpoint with a private DNS zone. Make sure the subscription and resource group are correct, and then select Next: Tags.

Screenshot showing how to integrate your private endpoint with a private DNS zone.

You can optionally apply tags to categorize your resources, such as applying the name Environment and the value Test to all testing resources. Enter any name/value pairs, and then select Next: Review + create.

Screenshot showing how to optionally tag your private endpoint with name/value pairs for easy categorization.

Select Create to create the private endpoint.

Verify connectivity

Run the checks from a client in the virtual network, or from a connected network with DNS configured to resolve the private endpoint. For the differences between resource providers, see DNS resolution. Use the original host name to mount the share, not the privatelink name.

Run the following DNS lookup from PowerShell, the command line, or a terminal on Windows, Linux, or macOS.

Replace <storage-account-name> with the appropriate storage account name:

nslookup <storage-account-name>.file.core.windows.net

If successful, you see output similar to the following, where 192.168.0.5 is the private IP address of the private endpoint in your virtual network (output shown for Windows).

Server:  UnKnown
Address:  10.2.4.4

Non-authoritative answer:
Name:    storageaccount.privatelink.file.core.windows.net
Address:  192.168.0.5
Aliases:  storageaccount.file.core.windows.net

Use the file share's host name. On the file share's Overview page, select JSON View. Under properties, copy the value of hostName. The format looks like fs-xxxxxxxxxxxxxxxxx.xx.file.storage.azure.net.

nslookup <file-share-host-name>

If successful, you see output similar to the following, where 192.168.0.5 is the private IP address of the private endpoint in your virtual network (output shown for Windows).

Server:  UnKnown
Address:  10.2.4.4

Non-authoritative answer:
Name:    <hostNamePrefix>.privatelink.file.core.windows.net
Address:  192.168.0.5
Aliases:  <hostNamePrefix>.<zone>.file.storage.azure.net

Restrict public endpoint access

You can disable public network access or keep it enabled for selected networks. These configurations are separate. Private endpoints continue to work in either configuration.

For classic file shares, configure public access on the storage account. For Microsoft.FileShares, configure it on the individual file share.

Classic file shares can also use a network security perimeter, subject to its protocol limitations. In Enforced mode, a perimeter denies traffic through service endpoints that don't have an assigned IP address. Clients must use a private endpoint or a standard service endpoint.

Disable public network access

When you disable public network access, clients can't connect through the public endpoint, including through service endpoints. Clients can still connect through private endpoints. This setting doesn't restrict outbound traffic from the clients.

Note

For classic file shares, existing trusted service and resource instance exceptions remain in effect after you disable public network access. Review these exceptions if you require access only through private endpoints. See Exceptions for Azure services.

To disable public network access for classic file shares, follow these steps:

  1. Go to the storage account where you want to restrict all inbound access to the public endpoint.
  2. From the service menu, under Security + networking, select Networking.
  3. Under Public network access, select Manage.
  4. Select Disable, and then select Proceed.
  5. Select Save.

Screenshot showing how to disable public network access on a storage account.

Go to the file share where you want to disable public access. From the service menu, under Settings, select Networking. For Public endpoints access, select Disabled, and then select Save.

Screenshot showing how to disable public endpoint access on a Microsoft.FileShares file share.

Restrict access to the public endpoint to specific networks

To allow clients from selected subnets, keep public network access enabled, enable service endpoints on those subnets, and add the subnets to the resource's network rules. You can use service endpoints with or without private endpoints. Subnets can be in other regions, subscriptions, and Microsoft Entra tenants. To add a subnet from another tenant, use PowerShell or the Azure CLI. For considerations, see Virtual network rules.

For SMB and FileREST access, you can also add IP address rules. IP address rules don't grant NFS access. For NFS access, use a virtual network rule. If the storage account is in a network security perimeter, you can use a standard service endpoint instead.

The PowerShell and CLI examples assume public network access is already enabled. The Microsoft.FileShares examples also assume the client subnet already has the Microsoft.Storage service endpoint. To configure that endpoint, see Enable service endpoints on a subnet.

For classic file shares, follow these steps to restrict the public endpoint to specific networks.

  1. Go to the storage account where you want to restrict the public endpoint to specific networks.
  2. From the service menu, under Security + networking, select Networking.
  3. Under Public network access, select Manage.
  4. Under Public network access scope, select Enabled from selected networks, and then select Save.
  5. Under Resource settings: Virtual networks, IP addresses, and exceptions, select Manage.
  6. Under Virtual Networks, select Add a virtual network > Add existing virtual network. Select the virtual network and subnets. If a subnet doesn't have the Microsoft.Storage service endpoint, select Enable and wait for the operation to finish. Then select Add.
  7. For SMB or FileREST access, under IPv4 Addresses, enter the public IP addresses or ranges that you want to allow. IP address rules don't grant NFS access.
  8. If a service integration requires trusted service access, under Exceptions, select Allow trusted Microsoft services to access this resource.
  9. Select Save.

Screenshot of the Resource access settings page for a storage account, with the Add a virtual network menu open.

For Microsoft.FileShares, follow these steps to restrict the public endpoint to specific networks.

  1. Go to the file share where you want to restrict public access.
  2. From the service menu, under Settings, select Networking.
  3. Make sure that Public endpoints access is set to Enabled.
  4. Under Public endpoint restrictions, select Add a virtual network. Select the virtual network and subnets. If a subnet doesn't have the Microsoft.Storage service endpoint, select Enable and wait for the operation to finish. Then select Add.
  5. Select Save.

Screenshot of the Networking page for a Microsoft.FileShares file share, with public endpoint access enabled and one allowed subnet.

Allow access from a standard service endpoint

By using a standard service endpoint, clients in a subnet can reach a storage account in a network security perimeter through a service endpoint. One inbound access rule in the perimeter profile allows every subnet that uses the service endpoint's IP address. The rule applies to SMB, NFS, and FileREST.

The following steps create a public IP address, assign it to the subnet's Microsoft.Storage service endpoint, and add an inbound access rule for the address to the perimeter profile.

Keep these points in mind:

  • The storage account must be associated with a network security perimeter. To create a perimeter and associate the storage account, see Quickstart: Create a network security perimeter - Azure portal.
  • The subnet must already have the Microsoft.Storage service endpoint. To add it, see Restrict access to the public endpoint to specific networks.
  • The public IP address must use the Standard SKU, static allocation, and IPv4. It must be in the same region as the virtual network.
  • You can assign the same IP address to other subnets and virtual networks in the same region, including virtual networks in other subscriptions in the same Microsoft Entra tenant.
  • All service endpoints on a subnet must use the same IP address.
  • Assigning or changing the IP address resets active connections from the subnet. Plan the change for a maintenance window.
  • To assign a public IP address to a service endpoint, you need the Microsoft.Network/publicIPAddresses/joinServiceEndpointNetworkIdentifier/action permission. The Network Contributor role includes this permission.
  • Virtual network rules that allow the subnet continue to apply until the perimeter association is in Enforced mode.
  • You can also add the IP address to the storage account's IP address rules instead of a perimeter rule. Without a perimeter, a basic service endpoint with a virtual network rule gives the same access at no extra charge.

To allow access from a standard service endpoint, follow these steps. For more information, see Configure a standard service endpoint using the Azure portal.

  1. In the search box at the top of the Azure portal, enter Public IP addresses. Select Public IP addresses in the search results.
  2. Select + Create.
  3. On the Basics tab, select the subscription, resource group, and the region of your virtual network. Enter a name. For IP Version, select IPv4. For SKU, select Standard.
  4. Select Review + create, and then select Create.
  5. After the deployment finishes, go to the new public IP address. Copy the value of IP address.
  6. Go to the virtual network that contains the client subnet. From the service menu, under Settings, select Subnets. Select the subnet.
  7. Under Service Endpoints, for Network identifier subscription, select the subscription of the public IP address. For Network identifier, select the public IP address that you created.
  8. In the Services list, for Microsoft.Storage, select Enable network identifier. Select Save.
  9. Go to the network security perimeter that the storage account is associated with. From the service menu, under Settings, select Profiles. Select the profile that the storage account is associated with.
  10. From the service menu, under Settings, select Inbound access rules. Select Add.
  11. For Rule name, enter a name. For Source type, select IP address ranges. For Allowed sources, enter the IP address that you copied, followed by /32. Select Add.

Microsoft.FileShares doesn't support network security perimeters. Clients in a subnet that has a standard service endpoint can still access a Microsoft.FileShares file share if the subnet is in the file share's allowed subnets. For steps, see Restrict access to the public endpoint to specific networks.

Restrict outbound access to specific storage accounts

Network rules for a file share control inbound access. They don't limit which other storage resources clients can access. For classic file shares, you can use a service endpoint policy to limit which storage accounts clients in a subnet can access through service endpoints. The policy filters destinations for traffic that bypasses Azure Firewall and network virtual appliances. It doesn't restrict other outbound paths or replace the destination's network rules and authorization requirements. For more information, see Restrict outbound access with service endpoint policies.

Important

Service endpoint policies don't support Microsoft.FileShares file shares. A policy on the client subnet blocks access to those file shares through service endpoints, even if it allows their subscription or resource group. This restriction also applies to subnets that access both classic and Microsoft.FileShares file shares. Clients in that subnet must use a private endpoint to access Microsoft.FileShares file shares.

A service endpoint policy defines the allowed storage destinations for clients in the associated subnet. It blocks those clients from accessing other storage accounts through service endpoints. Keep these points in mind:

  • Add every storage account that clients in the subnet use before you associate the policy with the subnet. This list includes storage accounts that other workloads in the subnet use.
  • The service endpoint policy must be in the same region and subscription as the virtual network.
  • A policy can contain only one policy definition for the Microsoft.Storage service. To allow more storage accounts, add their resource IDs to the same policy definition. You can also allow all storage accounts in a resource group or subscription.
  • After you associate a policy with a subnet, the policy applies to traffic to storage accounts in all regions.
  • These steps assume that the subnet has no service endpoint policies. If policies are already associated, review and update those policies instead of replacing their associations. The PowerShell and CLI examples stop if they find existing associations.

To create a service endpoint policy and associate it with a subnet, follow these steps. For detailed steps, see Create and associate service endpoint policies.

  1. In the search box at the top of the Azure portal, enter Service endpoint policy. Select Service endpoint policies in the search results.
  2. Select + Create.
  3. On the Basics tab, select the subscription and region of your virtual network. Select a resource group, and enter a name for the policy.
  4. Select Next: Policy definitions.
  5. Select + Add a resource. For Service, select Microsoft.Storage. For Scope, select Single account, and then select the storage account that contains your file shares. Select Add. Repeat this step for each storage account that clients in the subnet use.
  6. Select Review + Create, and then select Create.
  7. Go to the new service endpoint policy. From the service menu, under Settings, select Associated subnets.
  8. Select Edit subnet association, select the virtual network and subnet, and then select Apply.

To access a Microsoft.FileShares file share from a subnet that has a service endpoint policy, create a private endpoint for the file share. Service endpoint policies don't apply to traffic that goes through a private endpoint.

Configure routing preference

Routing preference controls how traffic from clients outside Azure reaches the public endpoint. It's available only for classic HDD file shares that use the pay-as-you-go billing model in StorageV2 storage accounts. For concepts, see Public endpoint network routing.

Important

Don't use internet routing for Azure Files. Internet routing doesn't support Active Directory (AD) domain join scenarios or Azure File Sync. Keep the default, Microsoft routing.

To check the routing preference and set it to Microsoft routing, follow these steps.

  1. Go to the storage account.
  2. From the service menu, under Security + networking, select Networking.
  3. Select the Network routing tab.
  4. Under Routing preference, make sure that Microsoft network routing is selected.
  5. If you changed the setting, select Save.

Microsoft.FileShares doesn't support routing preference.

Related content

  • Last updated on