Storage account network connectivity issues

Question

Storage account network connectivity issues

Nana Poku 245

We have issues with logic apps being unable to access storage accounts within Azure, when doing error check, there are some errors around the blob and file services. Deleting the private endpoint and recreating them resolved the issue.

Upon further checks I realised we had public access in our storage account enabled and private endpoint also enabled, would this be the cause of the connectivity error ?

Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-02-28T16:58:37.4033333+00:00

Hi Nana Poku ,

your understanding is correct Yes having both public access and a private endpoint enabled on your Azure storage account can indeed cause connectivity issues. When a private endpoint is configured, it creates a private IP address within your virtual network, and the storage account should ideally be accessed through this private endpoint. If public access is also enabled, it can lead to conflicts and connectivity problems because the traffic might not be routed correctly. I suggest few key points to consider,

When a private endpoint is created, a private DNS zone is typically configured to resolve the storage account's FQDN to the private IP address. If public access is enabled, DNS resolution might still point to the public endpoint, causing connectivity issues

Ensure that your storage account's firewall and virtual network rules are configured to allow access only through the private endpoint. Public access should be disabled to avoid conflicts

If you have service endpoints configured, they might interfere with the private endpoint. It's generally recommended to use either service endpoints or private endpoints, but not both simultaneously

Please disable public access on your storage account and ensure that all traffic is routed through the private endpoint. This will help maintain a consistent and secure connection to your storage account.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Nana Poku 245 Reputation points

2025-02-28T17:16:48.8166667+00:00

Thank you for this and I will go through the link attached as well.
Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-02-28T18:02:04.8266667+00:00

Hi Nana Poku ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Nana Poku 245 Reputation points

2025-03-01T15:03:25.2866667+00:00

Yes been facing further connectivity issues even after disabling public access and using the private endpoint.
Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-03-03T18:08:51.4366667+00:00

Hi Nana Poku ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-03-04T22:44:08.9633333+00:00

Hi Nana Poku ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Accepted answer

0 additional answers

Your answer

Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-02-28T16:58:37.4033333+00:00

Hi Nana Poku ,

your understanding is correct Yes having both public access and a private endpoint enabled on your Azure storage account can indeed cause connectivity issues. When a private endpoint is configured, it creates a private IP address within your virtual network, and the storage account should ideally be accessed through this private endpoint. If public access is also enabled, it can lead to conflicts and connectivity problems because the traffic might not be routed correctly. I suggest few key points to consider,

When a private endpoint is created, a private DNS zone is typically configured to resolve the storage account's FQDN to the private IP address. If public access is enabled, DNS resolution might still point to the public endpoint, causing connectivity issues

Ensure that your storage account's firewall and virtual network rules are configured to allow access only through the private endpoint. Public access should be disabled to avoid conflicts

If you have service endpoints configured, they might interfere with the private endpoint. It's generally recommended to use either service endpoints or private endpoints, but not both simultaneously

Please disable public access on your storage account and ensure that all traffic is routed through the private endpoint. This will help maintain a consistent and secure connection to your storage account.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Nana Poku 245 Reputation points

2025-02-28T17:16:48.8166667+00:00

Thank you for this and I will go through the link attached as well.
Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-02-28T18:02:04.8266667+00:00

Hi Nana Poku ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Nana Poku 245 Reputation points

2025-03-01T15:03:25.2866667+00:00

Yes been facing further connectivity issues even after disabling public access and using the private endpoint.
Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-03-03T18:08:51.4366667+00:00

Hi Nana Poku ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-03-04T22:44:08.9633333+00:00

Hi Nana Poku ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Answer 1

Hi Nana Poku ,

Ensure that the DNS settings are correctly configured. Perform an nslookup for your storage account to verify it resolves to the private endpoint's IP address. For example:

nslookup <storage-account-name>.blob.core.windows.net

The result should show the private endpoint's IP address

Check the NSG rules associated with your virtual network. Ensure that the outbound rules allow traffic to the private endpoint's IP address

If you are using a private DNS zone, make sure the virtual network is linked to the private DNS zone and that the DNS records are correctly configured

Use Azure Monitor to check if data is flowing through the private endpoint. Go to the private endpoint resource, select Metrics, and look at Bytes In or Bytes Out to see if there's any activity

Use the Connection troubleshoot feature in Azure Network Watcher to test connectivity from your VM to the storage account. This can help identify any network issues

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Keshavulu Dasari 4,840 Reputation points Microsoft External Staff Moderator

2025-03-05T16:39:31.9833333+00:00

Hi Nana Poku ,

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Share via

Storage account network connectivity issues

0 additional answers

Your answer