Does Azure Resource Manager is a service in the trusted Azure services list exception for storage account?

Question

Does Azure Resource Manager is a service in the trusted Azure services list exception for storage account?

Simon Tremblay 20

In the documentation here https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#trusted-services we can't find any indication about Azure Resource Manager. Do you know if Azure Resource Manager is a part of trusted Azure services when we check that option in Network tab?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Marcin Policht 87,730 MVP Volunteer Moderator

ARM operates on the control plane - the services listed in the article you referenced are managed by corresponding resource providers.

ARM typically operates via management APIs and doesn’t need direct, network-level access to data within a storage account. ARM orchestrates deployments but doesn’t itself access storage account contents over the network; the resources it deploys would access the storage account as needed (e.g., VMs with managed identities).

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Simon Tremblay 20 Reputation points

2024-11-07T21:02:53.8966667+00:00

Only to a bring a precision here. In the documentation about Linked templates it talks about using storage account for the Microsoft.Resources/deployments (in the uri parameter). Ref.: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/linked-templates?tabs=azure-powershell#linked-template

What I want to know if my storage account is only accessible by a private endpoint (no public access). Does using the exception for trusted Azure services list will allow the deployments resource to access to my storage account?
Simon Tremblay 20 Reputation points

2024-11-07T21:04:12.4066667+00:00

I forgot to mention the reference of trusted Azure services list: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-to-trusted-azure-services
Marcin Policht 87,730 Reputation points MVP Volunteer Moderator

2024-11-07T21:28:17.8233333+00:00

Appreciate the clarification. AFAIK, when you restrict a storage account to only be accessible via a private endpoint, enabling the "Allow trusted Azure services" exception will not grant Azure Resource Manager (ARM) access to that storage account over the private endpoint.

If your storage account is accessible exclusively through a private endpoint, it is isolated from public network access. Only resources within the virtual network (or with proper peering) can access the storage account through that endpoint. The "Allow trusted Azure services" setting applies to public network access only and it does not override or enable access via a private endpoint.

One approach to allowing ARM for deployments to access the storage account would be to temporarily disable the private endpoint restriction and re-enable it afterward - although that's obviously not ideal.

Alternatively, consider using Azure Storage firewall and network settings to configure specific IP ranges or subnets to allow ARM access without broader public exposure.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Share via

Does Azure Resource Manager is a service in the trusted Azure services list exception for storage account?

0 additional answers

Your answer