- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
Configure and Troubleshoot Azure Storage Service Endpoints
In this Azure lab, you lock down a Blob Storage account so that only workloads on an approved virtual network can reach it, then troubleshoot the connectivity issue caused by the new restriction. Working in the Azure portal, you inspect the virtual network, its subnets, the virtual machines, and the storage account that holds a team's nightly export files. You then restrict the storage account to a selected subnet and verify the service endpoint that enables that access. You validate that the intended workload can still read its data, then investigate why a second workload on another subnet can no longer reach the storage account, identify the network rule blocking it, and restore access in the same way. By the end, you can restrict Azure Storage to selected networks with service endpoints and diagnose VM-to-Blob connectivity failures caused by network restrictions.
Lab Info
Table of Contents
-
Challenge
Inspect the network and storage resources
- Review the virtual network, its two subnets, and the network settings of the two virtual machines.
- Review the storage account, the export container, and the current network access configuration showing all networks allowed.
- From the application VM, retrieve the sample blob to confirm access works while the account is open to all networks.
-
Challenge
Restrict storage access to the application subnet
- Configure the storage account's network access to allow traffic from selected virtual networks only.
- Add the application virtual network and its application subnet to the storage account's allowed networks.
- Verify that the
Microsoft.Storageservice endpoint is now enabled on the application subnet.
-
Challenge
Validate restricted access for the intended workload
- Confirm the storage account's networking view lists the application subnet as allowed and shows all other traffic denied.
- From the application VM, retrieve the sample blob again to confirm the intended workload still has access under the restriction.
-
Challenge
Diagnose and restore Blob access for the operations workload
- From the operations VM, observe that the same blob request now fails after the restriction.
- Review the storage account's network rules, the operations subnet's service endpoint state, and the operations VM's network interface settings to isolate what blocks the request.
- Add the operations subnet to the storage account's allowed networks, which enables the service endpoint on that subnet.
- Confirm the operations VM retrieves the blob and explain the configuration change that restored access.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.