Service Endpoint vs Private Endpoint for Azure Storage
A storage account should accept traffic only from one subnet, but the team does not want to create a private IP address for the service in the virtual network. What should they enable?
Quick Answer
The answer is to enable a service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone without creating a private IP address for the service in the virtual network. A service endpoint extends the virtual network identity to Azure Storage, letting the storage account firewall restrict traffic to that specific subnet while traffic flows over Microsoft’s core network rather than the public internet. On the AZ-104 exam, this scenario tests your understanding of the core difference between service endpoints and private endpoints: service endpoints do not assign a private IP to the PaaS resource, making them the correct choice when the requirement explicitly avoids a private IP. A common trap is confusing this with a private endpoint, which does create a private IP and is used for fully isolating the service into the VNet. Memory tip: “Service endpoint = subnet identity without a private IP; Private endpoint = a private IP for the service itself.”
⚠ Common exam trap
Many exam-takers confuse private endpoints (which assign a private IP) with service endpoints (which do not), leading candidates to incorrectly choose private endpoint when the question explicitly prohibits creating a private IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.
Service endpoints allow a subnet to access Azure PaaS services (like Storage) over the Azure backbone without requiring a private IP address. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow traffic only from that subnet, the team meets the requirement securely and cost-effectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Private endpoint, because it is the only way to allow one subnet.
Why it's wrong here
Private endpoints are not required when the goal is only to restrict access to a subnet without assigning a private IP to the service.
When this WOULD be correct
A question where the requirement is to ensure that traffic to the storage account never traverses the public internet and remains entirely within the Microsoft backbone, and the team is willing to create a private IP for the service in the virtual network.
- ✓
Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.
Why this is correct
A service endpoint lets you restrict storage access to a specific subnet without creating a private IP for the service in the virtual network.
- ✗
User-assigned managed identity, because it controls subnet access.
Why it's wrong here
Managed identities are for authentication, not for subnet-based network access control.
When this WOULD be correct
When a question asks for a way to grant a virtual machine or Azure resource access to a storage account without using storage account keys, and the solution must avoid hard-coding credentials. User-assigned managed identity would be correct for that scenario.
- ✗
Blob soft delete, because it helps restrict where traffic comes from.
Why it's wrong here
Soft delete protects deleted data, but it does not control network access or source subnet restrictions.
When this WOULD be correct
A question asks: 'Which feature protects against accidental deletion of blobs by retaining deleted data for a specified period?' Blob soft delete would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.Correct answer▾
Why this is correct
A service endpoint lets you restrict storage access to a specific subnet without creating a private IP for the service in the virtual network.
✗Private endpoint, because it is the only way to allow one subnet.Wrong answer — click to see why▾
Why this is wrong here
Private endpoint assigns a private IP to the storage account in the virtual network, which the team explicitly wants to avoid. The question requires restricting access to one subnet without creating a private IP, so service endpoint is correct.
★ When this WOULD be the correct answer
A question where the requirement is to ensure that traffic to the storage account never traverses the public internet and remains entirely within the Microsoft backbone, and the team is willing to create a private IP for the service in the virtual network.
Why candidates choose this
Candidates may confuse private endpoints with service endpoints, thinking both provide subnet-level access control, but private endpoints involve private IPs and are often seen as more secure, leading to selection despite the constraint against private IPs.
✗User-assigned managed identity, because it controls subnet access.Wrong answer — click to see why▾
Why this is wrong here
User-assigned managed identity controls authentication and authorization, not network-level access. It does not restrict traffic to a specific subnet.
★ When this WOULD be the correct answer
When a question asks for a way to grant a virtual machine or Azure resource access to a storage account without using storage account keys, and the solution must avoid hard-coding credentials. User-assigned managed identity would be correct for that scenario.
Why candidates choose this
Candidates may confuse managed identities with service endpoints or private endpoints, thinking they provide network access control, when they actually provide identity-based access.
✗Blob soft delete, because it helps restrict where traffic comes from.Wrong answer — click to see why▾
Why this is wrong here
Blob soft delete is a data protection feature that recovers deleted blobs; it does not restrict network traffic to a subnet.
★ When this WOULD be the correct answer
A question asks: 'Which feature protects against accidental deletion of blobs by retaining deleted data for a specified period?' Blob soft delete would be the correct answer.
Why candidates choose this
Candidates may confuse 'soft delete' with 'network security' because both involve 'delete' and 'restrict' in their descriptions, leading to a mistaken belief that soft delete can filter traffic.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
Key term
Private IP address
A private IP address is a non-internet-routable address used within a local network to identify devices and allow them to communicate with each other without direct exposure to the public internet.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web app in VNet1 must access a storage account by using a private IP address, and the storage account has public network access disabled. The app resolves the storage FQDN from inside the VNet. What should you deploy?
medium- A.A service endpoint on the subnet so the storage account gets a private IP.
- ✓ B.A private endpoint for the storage account and the required private DNS zone linkage.
- C.A storage account firewall rule that allows the VNet and a public DNS record update.
- D.A SAS token created for the application service principal.
Why B: A private endpoint assigns the storage account a private IP address from the VNet, enabling access via a private IP while public network access is disabled. The required private DNS zone linkage ensures the storage FQDN resolves to that private IP from within the VNet, meeting both requirements.
Variation 2. An application in AppSubnet must access an Azure Storage account over the public endpoint, but only traffic from that subnet should be allowed, and the traffic should stay on the Microsoft backbone. The administrator does not want to create a private IP for the service. Which two actions should be taken? Select two.
hard- ✓ A.Enable a service endpoint for Microsoft.Storage on AppSubnet.
- ✓ B.Configure the storage account firewall to allow AppSubnet.
- C.Create a private endpoint in AppSubnet.
- D.Disable public network access on the storage account.
- E.Assign a public IP address to the storage account.
Why A: Enabling a service endpoint for Microsoft.Storage on AppSubnet (Option A) allows traffic from that subnet to route to the Azure Storage account over the Microsoft backbone while still using the public endpoint. In addition, the storage account firewall must be configured to allow traffic from AppSubnet (Option B); without this rule, the service endpoint traffic will be rejected. Together these actions fulfill the requirements without creating a private IP.
Variation 3. An existing application in AppSubnet1 must access an Azure Storage account. The team does not want to add a private endpoint or change DNS records, but they do want to allow access only from AppSubnet1. Which configuration should the administrator use?
medium- ✓ A.Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.
- B.Create a private endpoint and remove all public network access from the storage account.
- C.Add a network security group rule that allows outbound TCP 443 to the storage account.
- D.Enable peering between AppSubnet1 and the storage account network.
Why A: Enabling the Microsoft.Storage service endpoint on AppSubnet1 allows traffic from that subnet to be routed directly to the Azure Storage service over the Azure backbone network, bypassing the internet. By then restricting the storage account's firewall to 'selected virtual networks' and adding AppSubnet1's virtual network and subnet, access is limited exclusively to that subnet without needing a private endpoint or DNS changes.
Variation 4. An application in a subnet must access an Azure Storage account over a private IP. The storage account must not be reachable through its public endpoint, and access should be limited to that subnet only. Which configuration should the administrator implement?
medium- A.Create a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.
- ✓ B.Create a private endpoint in the subnet and disable public network access on the storage account.
- C.Use a shared access signature token and leave network settings unchanged.
- D.Associate the storage account with a NAT gateway to control inbound access.
Why B: A private endpoint assigns a private IP from the subnet to the storage account, effectively bringing the service into the virtual network. Disabling public network access ensures the storage account is only reachable via that private endpoint, meeting the requirement to block public endpoint access and limit access to the specific subnet.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.