Create, change, or delete service endpoint policy using the Azure portal
Service endpoint policies enable you to filter virtual network traffic to specific Azure resources, over service endpoints. If you're not familiar with service endpoint policies, see service endpoint policies overview to learn more.
In this tutorial, you learn how to:
- Create a service endpoint policy
- Create a service endpoint policy definition
- Create a virtual network with a subnet
- Associate a service endpoint policy to a subnet
If you don't have an Azure subscription, create a free account before you begin.
Sign in to Azure
Sign in to the Azure portal.
Create a service endpoint policy
- Select + Create a resource on the upper, left corner of the Azure portal.
- In search pane, type "service endpoint policy" and select Service endpoint policy and then select Create.
Enter, or select, the following information in Basics
- Subscription : Select your subscription for policy
- Resource group : Select Create new and enter myResourceGroup
- Name : myEndpointPolicy
- Location : Central US
Select + Add under Resources and enter or select the following information in Add a resource pane
- Service : Only Microsoft.Storage is available with Service Endpoint Policies
- Scope : Select one out of Single Account, All accounts in subscription and All accounts in resource group
- Subscription : Select your subscription for storage account. Policy and storage accounts can be in different subscriptions.
- Resource group : Select your resource group. Required, if scope is set as, "All accounts in resource group" or "Single account".
- Resource : Select your Azure Storage resource under the selected Subscription or Resource Group
- Click on Add button at bottom to finish adding the resource
- Add more resources by repeating the above steps as needed
Optional: Enter or select, the following information in Tags:
- Key : Select your key for the policy. Ex: Dept
- Value : Enter value pair for the key. Ex: Finance
Select Review + Create. Validate the information and Click Create. To make further edits, click Previous.
View endpoint policies
In the All services box in the portal, begin typing service endpoint policies. Select Service Endpoint Policies.
Under Subscriptions, select your subscription and resource group, as shown in the following picture
Select the policy and click on Policy Definitions to view or add more policy definitions.
Select Associated subnets to view the subnets the policy is associated. If no subnet is associated yet, follow the instructions in the next step.
Associate a policy to a subnet
Ensure that all the resources accessed from the subnet are added to the policy definition before associating the policy to the given subnet. Once the policy is associated, only access to the allow listed resources will be allowed over service endpoints.
Also ensure that no managed Azure services exist in the subnet that is being associated to the service endpoint policy
Before you can associate a policy to a subnet, you have to create a virtual network and subnet. Please refer to the Create a Virtual Network article for help with this.
Once you have the virtual network and subnet are setup, you need to configure Virtual Network Service Endpoints for Azure Storage. On the Virtual Network blade, select Service endpoints, and in the next pane select Microsoft.Storage and under Subnets select the desired VNet or Subnet
Now, you can either choose to select the Service Endpoint Policy from the drop-down in the above pane if you have already created Service Endpoint policies before configuring Service Endpoint for the Subnet as shown below
OR if you are associating Service Endpoint policies after Service Endpoints are already configured, you can choose to associate the subnet from within the Service Endpoint Policy blade by navigating to the Associated Subnets pane as shown below
Access to Azure Storage resources in all regions will be restricted as per Service Endpoint Policy from this subnet.
In this tutorial, you created a service endpoint policy and associated it to a subnet. To learn more about service endpoint policies, see service endpoint policies overview.