Inquiry on Configuring Azure Functions and Storage Account Private Endpoints in an Isolated Network Environment

Question

We plan to use Azure Functions as the only component in the isolated network that can communicate with the internet. It will access external data through the Azure Firewall only.

We created and attached a Private Endpoint (PEP) for the Function, and also configured a subnet with a UDR that routes outbound traffic through the Azure Firewall, integrating it as the outbound virtual network.

How should the storage account used by the Function be configured in this case? Our internal policy requires every storage account to have a Private Endpoint. The storage account includes sub-resources such as Blob, Table, Queue, and File. Since the Function—especially when using Durable Functions—appears to require all of these resources, does that mean we need to create separate Private Endpoints for each one?

I’m also uncertain which subnet should be designated for these Private Endpoints. Should I use the same subnet where the Function’s Private Endpoint resides when creating them?

I apologize if my question is unclear due to my limited English proficiency.

Thank you.

Answer 1

Hi @Yu-Jeong Seo ,

Thanks for reaching out to Microsoft Q&A.

Since your internal policy mandates a Private Endpoint for every storage service in your storage account, you will indeed need to create separate Private Endpoints for each of these sub-resources. Azure Functions can access these resources through the Private Endpoints as long as they are correctly configured.

For the Private Endpoints, it’s best practice to use the same subnet where your Function's Private Endpoint resides or a different subnet within the same virtual network. This ensures that the Function App and the storage account can communicate securely over private links without routing through public endpoints.

When creating the Private Endpoints for your storage account:

• Navigate to your storage account in the Azure Portal.
• Go to the networking section. Add new Private Endpoints for each sub-service (Blob, Table, Queue, File).
• Ensure the Private Endpoints are routed to the same VNet where your Function’s Private Endpoint exists.

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

https://learn.microsoft.com/en-us/azure/azure-functions/functions-create-vnet

Hope it helps!

---

Please do not forget to click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you.