My subscription now enforce the Public network access being Disabled in my subscription, and even cannot allow upload from specific IP address, how can I access this storage account then

Question

Above setting cannot be changed by me,

there is no way for me to upload any files to blob storage now

Answer 1

Hello Yoi Xiang,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are unable to upload to the Azure Storage Blob account after the subscription started enforcing Public network access = Disabled.

When public network access is disabled, Azure Storage allows access only through a Private Endpoint/Private Link path, so adding your public IP address, changing firewall selected networks, using SAS, or trying another upload tool will not solve the issue if your client is still coming through the public endpoint. - https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-set-default-access, https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-overview

What you can do is to:

• Confirm whether Azure Policy or subscription governance changed or enforces publicNetworkAccess = Disabled.
• Create a Private Endpoint for the storage account’s blob sub-resource. - https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints
• Configure Private DNS using privatelink.blob.core.windows.net. - https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns
• Upload only from a client connected to the private network path, such as a VM in the VNet, peered VNet, VPN, or ExpressRoute.
• Confirm the user or workload has Blob data-plane permission such as Storage Blob Data Contributor. - https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access
• Escalate internally to the subscription/platform owner if you do not have permission to create the Private Endpoint, approve it, link DNS, or change the Azure Policy assignment. - https://learn.microsoft.com/en-us/azure/storage/common/policy-reference

Azure Support is not required if your platform or subscription owner can create the private endpoint, configure DNS, and assign RBAC. Azure Support should only be engaged after the correct private endpoint, DNS resolution, routing, and RBAC have been validated and the service still fails unexpectedly. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

---

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.