Allow Trusted Microsoft Services to Bypass Azure Storage Firewall
A backup job from an Azure service must write to a storage account that has the network firewall set to deny all public traffic. The team does not want to create a private endpoint for this workload. What should the administrator enable?
Quick Answer
The answer is to enable the "Allow trusted Microsoft services to access this storage account" setting. This is correct because Azure Storage firewalls include a built-in exception that permits specific Azure platform services, like Azure Backup, to bypass the public network deny rule without needing a private endpoint. These trusted services run on Microsoft-controlled infrastructure and are authenticated at the control plane, so they are not blocked by IP-based restrictions. On the AZ-104 exam, this scenario tests your understanding of storage network security and the distinction between public IP exceptions and service-level trust. A common trap is confusing this with adding a service tag or a specific IP range, but the key is that no public IP is involved—only Microsoft’s internal authentication. Memory tip: think of it as a "VIP pass" for Azure’s own services, not a public network rule.
⚠ Common exam trap
Many exam-takers confuse 'Allow trusted Microsoft services' with a generic security bypass, not realizing it is a specific, documented exception designed for Azure platform services like Backup, Log Analytics, and Azure Site Recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow trusted Microsoft services to access the storage account
Azure Storage firewalls include a special exception for 'Allow trusted Microsoft services to access this storage account'. When enabled, this exception permits Azure platform services—such as Azure Backup—to bypass the public network deny rule and write to the storage account without requiring a private endpoint. This works because the backup service runs on Microsoft-owned infrastructure that is authenticated and authorized at the control plane level, not via a public IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Allow trusted Microsoft services to access the storage account
Why this is correct
Allowing trusted Microsoft services is the correct choice when a supported Azure platform service needs to reach the storage account without opening the firewall broadly. It permits specific Microsoft-managed services to bypass the network restriction while keeping public traffic denied. This is appropriate when the workload is an Azure service rather than a customer VM or subnet.
- ✗
Add the backup server's public IP address to the storage firewall
Why it's wrong here
Azure backup workloads typically do not rely on a stable customer-controlled public IP that can be safely allowlisted here, and this would not match the private-by-design requirement.
When this WOULD be correct
This option would be correct if the backup server is an on-premises or non-Azure VM with a known static public IP address, and the storage account firewall is configured to allow access only from that IP.
- ✗
Create a service endpoint on the subnet that hosts the backup job
Why it's wrong here
Service endpoints apply to subnets and are intended for VM or subnet-based traffic, not for every Microsoft-managed backup integration scenario.
When this WOULD be correct
This option would be correct if the backup job runs on a virtual machine in a specific subnet, and the requirement is to allow that subnet to access the storage account without using a private endpoint. For example, a question where a VM in a VNet needs to back up to a storage account with a firewall, and the solution is to enable a service endpoint on the VM's subnet.
- ✗
Disable the storage account firewall temporarily during each backup window
Why it's wrong here
Temporarily disabling the firewall weakens security and is not a sustainable or recommended operational control.
When this WOULD be correct
If the question stated that the backup job fails intermittently due to firewall rules and the team needs a quick workaround while troubleshooting, temporarily disabling the firewall during the backup window could be a temporary fix, though not a best practice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Allow trusted Microsoft services to access the storage accountCorrect answer▾
Why this is correct
Allowing trusted Microsoft services is the correct choice when a supported Azure platform service needs to reach the storage account without opening the firewall broadly. It permits specific Microsoft-managed services to bypass the network restriction while keeping public traffic denied. This is appropriate when the workload is an Azure service rather than a customer VM or subnet.
✗Add the backup server's public IP address to the storage firewallWrong answer — click to see why▾
Why this is wrong here
The backup job is an Azure service (e.g., Azure Backup) that does not have a public IP address to add; it runs on Azure infrastructure. Adding a public IP would not work because the traffic originates from Azure's internal network, not a specific public IP.
★ When this WOULD be the correct answer
This option would be correct if the backup server is an on-premises or non-Azure VM with a known static public IP address, and the storage account firewall is configured to allow access only from that IP.
Why candidates choose this
Candidates may think that allowing a specific IP is a straightforward way to bypass the firewall, not realizing that Azure services do not have a fixed public IP and that the 'Allow trusted Microsoft services' setting is designed for this scenario.
✗Create a service endpoint on the subnet that hosts the backup jobWrong answer — click to see why▾
Why this is wrong here
Service endpoints allow access from a specific subnet to a storage account, but the backup job runs as an Azure service (e.g., Azure Backup) and not from a specific subnet. The question explicitly states the team does not want to use a private endpoint, and service endpoints still require the storage firewall to allow traffic from the subnet, which does not resolve the need to bypass the firewall for the Azure service itself.
★ When this WOULD be the correct answer
This option would be correct if the backup job runs on a virtual machine in a specific subnet, and the requirement is to allow that subnet to access the storage account without using a private endpoint. For example, a question where a VM in a VNet needs to back up to a storage account with a firewall, and the solution is to enable a service endpoint on the VM's subnet.
Why candidates choose this
Candidates may confuse service endpoints with managed identity or think that enabling a service endpoint on the subnet hosting the backup job will automatically grant access to the Azure Backup service, not realizing that the backup job is not tied to a specific subnet.
✗Disable the storage account firewall temporarily during each backup windowWrong answer — click to see why▾
Why this is wrong here
Disabling the firewall temporarily creates a security gap where the storage account is exposed to all public traffic during the backup window, violating the requirement to deny all public traffic.
★ When this WOULD be the correct answer
If the question stated that the backup job fails intermittently due to firewall rules and the team needs a quick workaround while troubleshooting, temporarily disabling the firewall during the backup window could be a temporary fix, though not a best practice.
Why candidates choose this
Candidates may think that temporarily disabling the firewall is a simple way to allow the backup job to succeed without understanding the security implications or the existence of the 'Allow trusted Microsoft services' option.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Diagnostic settings on an Azure storage account must send logs to a destination storage account that has its firewall set to deny all public network access. The team cannot create a private endpoint, but the destination service is one of the Azure services that can bypass the firewall as a trusted Microsoft service. What should the administrator enable?
hard- A.A service endpoint on the destination storage account subnet
- ✓ B.The Allow trusted Microsoft services to bypass this firewall setting
- C.A shared access signature with read permission
- D.A private DNS zone linked to the workspace virtual network
Why B: The 'Allow trusted Microsoft services to bypass this firewall' setting enables specific Azure services, such as Azure Monitor or Azure Backup, to write diagnostic logs to a storage account even when the storage account's firewall blocks all public network access. This bypass is controlled at the Azure platform level and does not require a private endpoint or public IP, making it the only viable solution when the destination storage account denies all public traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.