Configure a standard service endpoint using the Azure CLI

This article walks you through configuring a standard service endpoint using the Azure CLI. You create a public IP address as a network identifier, associate it with service endpoints on a subnet, configure a network security perimeter, and validate connectivity.

Important

Standard service endpoint is currently in public preview. This preview is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see Supplemental Terms of Use for Microsoft Azure Previews.

Prerequisites

An Azure account with an active subscription. If you don't have one, create an account for free.
Network Contributor role or higher on the subscription. Specifically, you need the Microsoft.Network/publicIPAddresses/joinServiceEndpointNetworkIdentifier/action permission. For more information, see network security perimeter role-based access control requirements.
Standard service endpoint is currently behind a feature flag. Before you configure it, register the AllowServiceEndpointNetworkIdentifier feature in your subscription by using these self-serve commands:
```
az feature register \
    --namespace Microsoft.Network \
    --name AllowServiceEndpointNetworkIdentifier
```
Verify the registration status:
```
az feature show \
    --namespace Microsoft.Network \
    --name AllowServiceEndpointNetworkIdentifier \
    --query "properties.state" \
    --output tsv
```
Wait for the state to show Registered, then refresh the resource provider registration:
```
az provider register --namespace Microsoft.Network
```
Azure CLI version 2.x or later. Run az --version to find the version. If you need to install or upgrade, see Install Azure CLI.

Use the Bash environment in Azure Cloud Shell. For more information, see Get started with Azure Cloud Shell.
If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
- If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Authenticate to Azure using Azure CLI.
- When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use and manage extensions with the Azure CLI.
- Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

Create a resource group

Create a resource group with az group create.

az group create \
  --name test-rg \
  --location eastus2

Create a virtual network

Create a virtual network and subnet with az network vnet create.

az network vnet create \
  --resource-group test-rg \
  --name vnet-1 \
  --address-prefix 10.0.0.0/16 \
  --subnet-name subnet-1 \
  --subnet-prefix 10.0.0.0/24 \
  --location eastus2

Create a NAT gateway

Create a NAT gateway v2 and associate it with subnet-1 to provide outbound internet connectivity for the virtual machine.

Create a public IP address for the NAT gateway with az network public-ip create.

az network public-ip create \
  --resource-group test-rg \
  --name public-ip-nat \
  --sku Standard \
  --allocation-method Static \
  --location eastus2

Create a NAT gateway with az network nat gateway create.

az network nat gateway create \
  --resource-group test-rg \
  --name nat-gateway \
  --location eastus2 \
  --public-ip-addresses public-ip-nat \
  --idle-timeout 4

Associate the NAT gateway with subnet-1 by using az network vnet subnet update.

az network vnet subnet update \
  --resource-group test-rg \
  --vnet-name vnet-1 \
  --name subnet-1 \
  --nat-gateway nat-gateway

Deploy Azure Bastion

Azure Bastion uses your browser to connect to VMs in your virtual network over secure shell (SSH) or remote desktop protocol (RDP) by using their private IP addresses. The VMs don't need public IP addresses, client software, or special configuration. For more information about Azure Bastion, see Azure Bastion.

Note

Hourly pricing starts from the moment that Bastion is deployed, regardless of outbound data usage. For more information, see Pricing and SKUs. If you're deploying Bastion as part of a tutorial or test, we recommend that you delete this resource after you finish using it.

Create an Azure Bastion host with az network bastion create.

az network bastion create \
  --name bastion \
  --resource-group test-rg \
  --vnet-name vnet-1 \
  --location eastus2 \
  --sku Basic

Create a virtual machine

Create a VM named vm-1 in the virtual network. The virtual machine is used to validate connectivity after configuration.

Create a virtual machine with az vm create.

az vm create \
  --resource-group test-rg \
  --name vm-1 \
  --image Ubuntu2204 \
  --vnet-name vnet-1 \
  --subnet subnet-1 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-address "" \
  --nsg nsg-1

Note

Virtual machines in a virtual network with an Azure Bastion host don't need public IP addresses. Bastion provides the public IP, and the VMs use private IPs to communicate within the network. You can remove the public IPs from any VMs in Bastion-hosted virtual networks. For more information, see Dissociate a public IP address from an Azure VM.

Note

Azure provides a default outbound access IP for VMs that either aren't assigned a public IP address or are in the backend pool of an internal basic Azure load balancer. The default outbound access IP mechanism provides an outbound IP address that isn't configurable.

The default outbound access IP is disabled when one of the following events happens:

A public IP address is assigned to the VM.
The VM is placed in the backend pool of a standard load balancer, with or without outbound rules.
An Azure NAT Gateway resource is assigned to the subnet of the VM.

VMs that you create by using virtual machine scale sets in flexible orchestration mode don't have default outbound access.

For more information about outbound connections in Azure, see Default outbound access in Azure and Use Source Network Address Translation (SNAT) for outbound connections.

Install tools on the virtual machine

Install cifs-utils and Azure CLI on the virtual machine by running a shell script with az vm run-command invoke.

az vm run-command invoke \
  --resource-group test-rg \
  --name vm-1 \
  --command-id RunShellScript \
  --scripts "sudo apt-get update && sudo apt-get install -y cifs-utils && curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash"

Create a storage account

Create an Azure storage account with a file share to use as the PaaS resource for testing connectivity through the service endpoint.

Create a storage account with az storage account create. Replace <storage-account-name> with a globally unique name.

az storage account create \
  --name <storage-account-name> \
  --resource-group test-rg \
  --location eastus2 \
  --sku Standard_LRS \
  --kind StorageV2

Create a file share with az storage share-rm create.

az storage share-rm create \
  --resource-group test-rg \
  --storage-account <storage-account-name> \
  --name fileshare-1

Create a public IP prefix

Create a public IP prefix and a public IP address instance to use as a network identifier.

Create a public IP prefix with az network public-ip prefix create.

az network public-ip prefix create \
  --resource-group test-rg \
  --name public-ip-prefix \
  --length 31 \
  --location eastus2

Create a public IP address from the prefix with az network public-ip create.

az network public-ip create \
  --resource-group test-rg \
  --name public-ip-1 \
  --public-ip-prefix public-ip-prefix \
  --sku Standard \
  --allocation-method Static

Configure service endpoints with a network identifier

This step is the key configuration for a standard service endpoint. You associate a public IP address as a network identifier with service endpoints on a subnet.

A network identifier is a public IP address that you assign to your service endpoint. The public IP isn't used for network routing decisions. When you create a public IP address within your subscription, it's automatically assigned from your service's designated IP pool. Services inside the network security perimeter use this public IP address to recognize service endpoint traffic and configure appropriate access rules.

Note

The public IP address used as the network identifier must meet all of the following requirements: Standard SKU, Static allocation method, IPv4, in Succeeded provisioning state, and must already exist before associating it with a service endpoint. NRP rejects the IP if any of these conditions aren't met.

Update the subnet to add a service endpoint with the public IP address as the network identifier using az network vnet subnet update.

az network vnet subnet update \
  --resource-group test-rg \
  --vnet-name vnet-1 \
  --name subnet-1 \
  --add serviceEndpoints '{"service":"Microsoft.Storage","networkIdentifier":{"id":"/subscriptions/<subscription-id>/resourceGroups/test-rg/providers/Microsoft.Network/publicIPAddresses/public-ip-1"}}'

Note

Replace <subscription-id> with your Azure subscription ID. You can find your subscription ID by running az account show --query id --output tsv.

The same public IP address can be assigned to all subnets in a region within a subscription. The network identifier is supported across subscriptions during the public preview.

Create a network security perimeter

Create a network security perimeter and associate your PaaS resources with it.

Create a network security perimeter with az network perimeter create.

az network perimeter create \
  --name nsp-1 \
  --resource-group test-rg \
  --location eastus2

Create a profile in the network security perimeter with az network perimeter profile create.

az network perimeter profile create \
  --perimeter-name nsp-1 \
  --resource-group test-rg \
  --name profile-1

Associate your storage account with the network security perimeter with az network perimeter association create. Replace <subscription-id> and <storage-account-name> with your values.

az network perimeter association create \
  --perimeter-name nsp-1 \
  --resource-group test-rg \
  --association-name assoc-storage \
  --access-mode Learning \
  --profile "{id:/subscriptions/<subscription-id>/resourceGroups/test-rg/providers/Microsoft.Network/networkSecurityPerimeters/nsp-1/profiles/profile-1}" \
  --private-link-resource "{id:/subscriptions/<subscription-id>/resourceGroups/test-rg/providers/Microsoft.Storage/storageAccounts/<storage-account-name>}"

Create a network security perimeter inbound access rule

Add an IP-based inbound access rule in the network security perimeter to authorize traffic from your network identifier. This rule matches the public IP address to enable connectivity from your service endpoints.

Create an inbound access rule with az network perimeter profile access-rule create. Replace <public-ip-prefix-range> with the address range of your public IP prefix.

az network perimeter profile access-rule create \
  --perimeter-name nsp-1 \
  --resource-group test-rg \
  --profile-name profile-1 \
  --access-rule-name allow-se-standard \
  --direction Inbound \
  --address-prefixes "<public-ip-prefix-range>"

Note

To find the address range of your public IP prefix, run az network public-ip prefix show --resource-group test-rg --name public-ip-prefix --query ipPrefix --output tsv.

Validate connectivity

Connect to your virtual machine with Azure Bastion and test connectivity to the storage account to validate that traffic is authorized by the network security perimeter inbound access rule.

Connect to the virtual machine

In the Azure portal, search for and select Virtual machines.
Select vm-1.
Select Connect, then select Connect via Bastion.

In the Bastion page, enter the following information:

Setting	Value
Authentication Type	Select SSH Private Key from Local File.
Username	Enter azureuser.
Local File	Select the vm-1-key.pem file you downloaded when you created the virtual machine.

Select Connect.

Test connectivity to the storage account

In the SSH session on vm-1, sign in to Azure CLI:
```
az login
```

Mount the Azure file share to validate connectivity to the storage account through the service endpoint. Replace <storage-account-name> with the name of your storage account:

sudo mkdir -p /mnt/fileshare-1
STORAGE_KEY=$(az storage account keys list \
    --resource-group test-rg \
    --account-name <storage-account-name> \
    --query "[0].value" -o tsv)

sudo mount -t cifs //<storage-account-name>.file.core.windows.net/fileshare-1 /mnt/fileshare-1 \
    -o username=<storage-account-name>,password=$STORAGE_KEY,serverino,nosharesock,actimeo=30,mfsymlinks

Verify that the file share mounts successfully:
```
df -h /mnt/fileshare-1
```
To confirm that the inbound access rule is working, check the network security perimeter diagnostic logs. For more information about network security perimeter diagnostic logs, see Diagnostic logging for network security perimeter.

Clean up resources

When you no longer need the resources created in this article, delete the resource group:

az group delete --name test-rg --yes --no-wait

Next steps

Feedback

Was this page helpful?

Last updated on 2026-07-22

Configure a standard service endpoint using the Azure CLI

Prerequisites

Create a resource group

Create a virtual network

Create a NAT gateway

Deploy Azure Bastion

Create a virtual machine

Install tools on the virtual machine

Create a storage account

Create a public IP prefix

Configure service endpoints with a network identifier

Create a network security perimeter

Create a network security perimeter inbound access rule

Validate connectivity

Connect to the virtual machine

Test connectivity to the storage account

Clean up resources

Next steps

Feedback

Additional resources