Service Endpoint and Firewall Rules to Restrict Storage Account to Subnet
A team wants an Azure Storage account to be reachable only from one subnet, but they do not want to use a private endpoint. Which two configurations should they use? Select two.
Quick Answer
The correct answer is to add the subnet to the storage account's networking rules and enable a Microsoft.Storage service endpoint on that subnet. This works because the service endpoint extends the virtual network’s identity to the storage service, allowing traffic from the subnet to reach the storage account over the Azure backbone while keeping the public endpoint enabled but restricted. The storage account firewall then blocks all other traffic, ensuring only that specific subnet has access. On the AZ-104 exam, this scenario tests your understanding of how service endpoints differ from private endpoints—a common trap is confusing the two, but remember that service endpoints work with the firewall to restrict a public endpoint, whereas private endpoints give a private IP. A helpful memory tip is “SEF” for Service Endpoint + Firewall: the service endpoint extends the network, and the firewall locks the door.
⚠ Common exam trap
Test-takers frequently confuse Azure RBAC roles (which control management access) with network-level access controls (firewall rules and service endpoints), leading them to incorrectly select option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone.
Enabling a Microsoft.Storage service endpoint on the subnet extends the virtual network identity to the storage service, allowing traffic from that subnet to reach the storage account over the Azure backbone network without using a public IP. This ensures private connectivity from the subnet to the storage account while keeping the storage account's public endpoint enabled but restricted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone.
Why this is correct
A service endpoint extends the subnet's identity to the storage service without creating a private IP address.
- ✓
Add the subnet to the storage account's networking rules so only that subnet is allowed through the storage firewall.
Why this is correct
The storage firewall must explicitly allow the subnet, otherwise the public endpoint remains blocked.
- ✗
Create a private endpoint and leave the firewall open to all networks so the subnet can be filtered later.
Why it's wrong here
A private endpoint is a different design and the firewall should not be left open when restriction is required.
When this WOULD be correct
If the question required secure access from a subnet without using a service endpoint, and the subnet was in a different VNet or required private IP connectivity, then a private endpoint would be the correct choice. For example: 'You need to access a storage account from a subnet in a peered VNet without traversing the internet.'
- ✗
Assign Contributor on the storage account to the subnet, because Azure roles control which networks can connect.
Why it's wrong here
RBAC controls actions, not network reachability to the storage endpoint.
When this WOULD be correct
In a scenario where the question asks how to grant a subnet's virtual machines permission to manage (e.g., read/write data in) a storage account, assigning the Contributor role to the subnet's managed identity or service principal would be correct.
- ✗
Disable the public endpoint and rely on Internet routing, because that is the only way to limit access to one subnet.
Why it's wrong here
Internet routing would not restrict access to one subnet and would not meet the security requirement.
When this WOULD be correct
If the question asked for a method to completely block all public access and allow access only through a private endpoint from a specific subnet, then disabling the public endpoint would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone.Correct answer▾
Why this is correct
A service endpoint extends the subnet's identity to the storage service without creating a private IP address.
✗Create a private endpoint and leave the firewall open to all networks so the subnet can be filtered later.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly states 'they do not want to use a private endpoint,' so creating a private endpoint contradicts the requirement. Additionally, leaving the firewall open to all networks would not restrict access to one subnet.
★ When this WOULD be the correct answer
If the question required secure access from a subnet without using a service endpoint, and the subnet was in a different VNet or required private IP connectivity, then a private endpoint would be the correct choice. For example: 'You need to access a storage account from a subnet in a peered VNet without traversing the internet.'
Why candidates choose this
Candidates may confuse private endpoints with service endpoints, thinking both are valid for subnet restriction, or they may overlook the explicit constraint against using a private endpoint in the question.
✗Assign Contributor on the storage account to the subnet, because Azure roles control which networks can connect.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC roles like Contributor control permissions to manage resources, not network access. Assigning Contributor to a subnet does not restrict network traffic to the storage account; it only grants management rights to identities in that subnet.
★ When this WOULD be the correct answer
In a scenario where the question asks how to grant a subnet's virtual machines permission to manage (e.g., read/write data in) a storage account, assigning the Contributor role to the subnet's managed identity or service principal would be correct.
Why candidates choose this
Candidates may confuse Azure RBAC with network access controls, thinking that assigning a role to a subnet will restrict connectivity, when in fact RBAC governs control plane operations, not data plane network access.
✗Disable the public endpoint and rely on Internet routing, because that is the only way to limit access to one subnet.Wrong answer — click to see why▾
Why this is wrong here
Disabling the public endpoint would make the storage account unreachable from the subnet without a private endpoint or service endpoint, and relying on Internet routing does not restrict access to a single subnet.
★ When this WOULD be the correct answer
If the question asked for a method to completely block all public access and allow access only through a private endpoint from a specific subnet, then disabling the public endpoint would be correct.
Why candidates choose this
Candidates may think that disabling the public endpoint inherently limits access to a specific subnet, not realizing that without a service endpoint or private endpoint, the subnet cannot reach the storage account at all.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?
medium- A.Create a private endpoint and disable public network access.
- ✓ B.Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.
- C.Generate a user delegation SAS token and distribute it only to the subnet.
- D.Change the redundancy setting to ZRS and enable soft delete.
Why B: A service endpoint extends the virtual network identity to the storage account over the public endpoint, allowing the administrator to restrict access to only traffic originating from that specific subnet via the storage account firewall. This meets the requirement of using the public endpoint while limiting access to a single Azure subnet without needing a private IP address.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.