Privatelink for blob storage is not resolvable, but the public link is resolvable - unable to use private endpoint for storage account

Question

We are attempting to utilize a private endpoint for our storage account with Veeam Backup for Azure. We have noticed that Veeam attempts to resovle storageaccountname.blob.core.windows.net and that correctly points to (The IP Address). However, when attempting to resovle storageaccountname.privatelink.blob.core.windows.net it fails. I have created an A record in the private DNS Zone, but it did not resolve the issue. I think I am missing the CNAME, but I do not see where I can create that record for blob.core.windows.net.

The troubleshooting suggested these two things, but I am not certain how to verify them: Make sure that the fully qualified domain name (FQDN) is assigned correctly, by having an A record (a basic type of DNS record) and a CName correctly configured to the Private Endpoint. The virtual machine (VM) making the request must have its virtual network properly associated with the private DNS zone.

Any help would be greatly appreciated. I've been staring at documentation so long, my head is beginning to spin. This may be what I am missing, but I'm unsure how to configure it https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints.

Answer 1

@Nathan Davis

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer. Accepted answers show up at the top, resulting in improved discoverability for others.

Issue: Privatelink for blob storage is not resolvable, but the public link is resolvable - unable to use private endpoint for storage account

Cause: Customer shared - We have found that for our Private DNS Zone the Virtual Network Link was not configured for the VNET in our testing subscription. Someone had erroneously linked the VNET for the testing subscription to the Private DNS Zone in our production subscription.

---

If your issue remains unresolved or have further questions, please let us know in the comments how we can assist. We are here to help you and strive to make your experience better and greatly value your feedback.

Answer 2

We have found that for our Private DNS Zone the Virtual Network Link was not configured for the VNET in our testing subscription. Someone had erroneously linked the VNET for the testing subscription to the Private DNS Zone in our production subscription.