What is the service endpoint `Microsoft.Storage.Global` for?

Question

Just saw the service endpoint Microsoft.Storage.Global, but can't see it documented anywhere.

What is it for? Vs. the Microsoft.Storage that has been there a while.

Documentation in question (where I expected to find information about said endpoint):

• https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

Related documentation issue that got closed without adding any information about said endpoint:

• https://github.com/MicrosoftDocs/azure-docs/issues/107997

Answer 1

@olavrb Thanks for your patience.

I got the confirmation from the Product team that -

• Azure.Storage.Global endpoint is about this feature in Public Preview - Enabling access to virtual networks in other regions (preview). Currently there is no mention of Azure.Storage.Global endpoint in this document with the explanation below, but an update is coming up as this feature goes to GA in the coming weeks.

By default, service endpoints work between virtual networks and service instances in the same Azure region.

When using service endpoints with Azure Storage (Azure.Storage), service endpoints also work between virtual networks and service instances in a paired region.

If you want to use a service endpoint (Azure.Storage.Global) to grant access to virtual networks in other regions, you must register the AllowGlobalTagsForStorage feature in the subscription of the virtual network. This capability is currently in public preview.

To enable access from a virtual network that is in another region over service endpoints, register the AllowGlobalTagsForStorage feature in the subscription of the virtual network. All the subnets in the subscription that has the AllowedGlobalTagsForStorage feature enabled will no longer use a public IP address to communicate with any storage account. Instead, all the traffic from these subnets to storage accounts will use a private IP address as a source IP. As a result, any storage accounts that use IP network rules to permit traffic from those subnets will no longer have an effect.

• Product team is in the process of releasing this feature to General Availability (GA).
• Microsoft official documentation updates are in progress. Documentation as well as announcements on the same feature are going to be released in a couple of weeks.

Hope this helps.

If you have any questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If this helps, please 'Accept answer' and 'mark as helpful' so that it can help others in the community looking for help on the same topic.

Answer 2

@olavrb It seems to be a preview feature :-

https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?toc=%2Fazure%2Fvirtual-network%2Ftoc.json&tabs=azure-portal#enabling-access-to-virtual-networks-in-other-regions-preview

One difference is:

The default Microsoft.Storage service endpoints work between virtual networks and service instances in the same Azure region. When using service endpoints with Azure Storage, service endpoints also work between virtual networks and service instances in a paired region.

However in Microsoft.Storage.Global option , subnet of a VNet in one region can connect to storage account in another region which are not region pairs. It is for AllowGlobalTagsForStorage

https://github.com/MicrosoftDocs/azure-docs/issues/104205

https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#managing-virtual-network-rules

To summarize , "Microsoft.Storage" can be used to connect to Storage service within the same region as the Vnet deployed region, where as the “Microsoft.Storage.Global” can be used to reach other region Storage service.

I think the document update is in progress: https://github.com/hashicorp/terraform-provider-azurerm/pull/21342

Answer 3

Getting error "you cannot select both microsoft.storage and microsoft.storage.global"

How to fix this.?

Answer 4

Even that is old - I had the same message today when trying to allow subnets on storage firewall for public endpoint. Go to Virtual Networks => Choose your Network. In the Menu (left) select Service Endpoints. You will see a list of Service Endpoints which are assigned to your subnets. In my case I deleted the 'Microsoft.Storage.Global' on the ... Menu behind the service. Afterwards the error did not come up again and I could assign subnets on the allowed networks in storage firewall. Storage endpoints were re-created afterwards. Please be sure that your 'Microsoft.Storage.Global' endpoints are not already used for anything. You will remove access to the storage via that Endpoint when you delete. Actually after adding subnets to the firewall, the storage endpoint menu list looked like before, but the error was gone ;)