AZ-104 Practice Question 33: Storage Vnet Rule Service Endpoint
Microsoft Azure Administrator Associate (AZ-104) · Test 4 · question 3 of 10
To lock down the storage account stapp01, you set Public network access to Enabled from selected virtual networks and IP addresses, and you add a virtual network rule for the subnet snet-app, where the application VMs run. You add no IP rules.
Immediately afterwards, every request from the application VMs fails with HTTP 403. The VMs' Azure RBAC role assignments on the account were not changed. What is the most likely cause?
Show answer and explanation
Answer:
A virtual network rule and a service endpoint are two halves of one configuration: "In the subnet's virtual network settings, you must also enable a Virtual Network *service endpoint*. This endpoint provides secure and direct connectivity to your storage account." The portal creates the endpoint for you as you pick each subnet, but rules added by PowerShell, the CLI, or a template do not, and Microsoft states the result plainly: "By default, traffic to all subnets is blocked. Requests to resources in a subnet receive a 403 error until you add a rule that allows traffic to that subnet." Note the endpoint type matters too: Microsoft.Storage reaches accounts in the same region as the virtual network, and Microsoft.Storage.Global is the cross-region variant.
Option B describes turning the firewall off. Selecting "Enabled from all networks" makes every network rule irrelevant; it does not make them work.
Option C cannot work, and the reason is worth remembering: "If you enable a service endpoint for a subnet, traffic from that subnet won't use a public IP address to communicate with a storage account. Instead, all traffic uses a private IP address as the source IP." IP network rules match public address ranges only.
Option D confuses network rules with authorisation. They are independent layers: "clients that make requests from allowed sources must also meet the authorization requirements of the storage account", and enabling a firewall never edits role assignments.
Reference: Configure Azure Storage firewalls and virtual networks