Troubleshooting Caller IPs in Azure Storage Logs

Question

What steps should I take to understand the caller IP addresses in Azure Storage diagnostic logs?

"PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community.""

Answer 1

Greetings!

To understand the caller IP addresses in Azure Storage diagnostic logs, follow these steps:

1. Check Diagnostic Logs: Ensure you have the storage diagnostic logs available.
2. Focus on Key Fields: Examine the callerIPAddress and userAgentHeader fields to determine the source of the operation.
3. Authorization Check: If Microsoft Entra ID is used for authorization, the RequestObjectId field will help identify the user. Shared Key and SAS authentication do not audit individual identities, making the callerIPAddress and userAgentHeader fields essential.
4. Verify IP Addresses: You can verify if the IP addresses belong to Azure resources by downloading the Azure IP ranges from the Microsoft Download Center.
5. Example Case: In a support scenario, an IP address provided by a customer was identified as belonging to Microsoft. This was confirmed by checking the user agent header and verifying against Azure IP ranges.

For more detailed information, you can refer to the Azure documentation on Auditing data plane operations.

Resources:

• Auditing data plane operations
• Download Azure IP and Service Tags – Public Cloud

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.