Access Azure File share through private endpoint

Shekar Yenagandula 116

I'm trying to enable backup using PowerShell for the file share of storage accounts. In current environment we disabled public network access and using only private endpoints. I have used Runbook with private endpoint but still failing to list the file share. Even through placed in same virtual network in Runbook and Storage accounts still failing to fetch. Any idea how we can resolve this? Appreciate your guidance or help

SaiKishor-MSFT 17,181 Reputation points

2023-02-02T00:54:24.0733333+00:00

@Shekar Yenagandula Thanks for reaching out to Microsoft Q&A. Can you share the exact command/script you are using to do this and what error you get exactly?

Shekar Yenagandula 116

Similar to the below code. It's not able to fetch the fileshare name and showing 403 error


foreach ($subscription in $subscriptions)                                              
 {Get-AzSubscription -SubscriptionName $subscription.Name | Set-AzContext
 # Get the list of storage accounts
    $storageAccounts = Get-AzStorageAccount
 # Loop through each storage account
     foreach ($storageAccount in $storageAccounts)
     {
# Get the list of file shares in the storage account
    $fileShares = Get-AzStorageShare -Context $storageAccount.Context
 # Print the storage account name and file share names
   Write-Output "Storage account: $($storageAccount.StorageAccountName)"
    Write-Output "File shares: $($fileShares.Name -join ", ")"
} 
}

Shekar Yenagandula 116 Reputation points

2023-02-02T05:13:50.08+00:00

I'm using the azure backup recovery service vault only. I want to automate for each file shares to check if enabled or not. If not then it will enable and move it tk rsv. If I have access to list all the file shares names then I can manage. I'm trying to fetch but it's not working at all. Tried different solutions but no use.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
SaiKishor-MSFT 17,181 Reputation points

2023-02-02T23:20:57.0166667+00:00

@Shekar Yenagandula

As per- https://learn.microsoft.com/en-us/azure/automation/automation-hrw-run-runbooks?tabs=sa-mi#plan-for-azure-services-protected-by-firewall

Enabling the Azure Firewall on Azure Storage, Azure Key Vault, or Azure SQL blocks access from Azure Automation runbooks for those services. Access will be blocked even when the firewall exception to allow trusted Microsoft services is enabled, as Automation is not a part of the trusted services list. With an enabled firewall, access can only be made by using a Hybrid Runbook Worker and a virtual network service endpoint.

Ideally, you would need to use the above 2 options and not private endpoint to get access to the storage account when firewall is enabled. Are you able to implement one of the above options and try the script above?

3 answers

Silvia Wibowo 2,851 Reputation points Microsoft Employee

2023-02-02T04:43:41.25+00:00

Hi @Shekar Yenagandula ,

I understand that your intention is to enable backup of your Azure Storage File share. Would you consider using Azure Backup? More info: Azure file share backup
Please sign in to rate this answer.
Shekar Yenagandula 116 Reputation points

2023-02-02T04:48:04.4366667+00:00

I'm using the azure backup recovery service vault only. I want to automate for each file shares to check if enabled or not. If not then it will enable and move it tk rsv. If I have access to list all the file shares names then I can manage. I'm trying to fetch but it's not working at all. Tried different solutions but no use.

Silvia Wibowo 2,851 Reputation points Microsoft Employee

2023-02-02T05:20:31.6166667+00:00

Hi @Shekar Yenagandula ,

Azure Automation account authentication can use Managed Identities or Run as Account. Which one do you use?

Runbooks in Azure Automation can run on either an Azure sandbox or a Hybrid Runbook Worker. Which one do you use?

Shekar Yenagandula 116 Reputation points

2023-02-02T05:23:40.97+00:00

@Silvia Wibowo I'm using System Managed Identity and not using Hybrid runbook worker.

Silvia Wibowo 2,851 Reputation points Microsoft Employee

2023-02-03T04:17:42.0033333+00:00

Have you checked that the authentication (in PowerShell script) is successful?
Sign in to comment
Limitless Technology 43,931 Reputation points

2023-02-02T17:17:36.9766667+00:00

Hello there,

So you are trying to Connect to an Azure File Share via a Private Endpoint right ?

Azure Files provides two main types of endpoints for accessing Azure file shares:

-Public endpoints, which have a public IP address and can be accessed from anywhere in the world.

-Private endpoints, which exist within a virtual network and have a private IP address from within the address space of that virtual network.

Connect to an Azure File Share via a Private Endpoint https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/file-share-private-endpoint/

Configuring Azure Files network endpoints https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-endpoints?tabs=azure-portal

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more