When to Use a Service Endpoint for Azure Storage
A company has a virtual machine in a subnet that must access an Azure Storage account. The storage account should remain reachable through its public endpoint, but access must be limited to that subnet, and the traffic should stay on the Azure backbone rather than the internet. Which feature should the administrator configure on the subnet?
Quick Answer
The answer is a service endpoint for Microsoft.Storage. This is correct because a service endpoint extends your virtual network’s identity to the storage account, allowing traffic from the specified subnet to reach the storage account’s public endpoint while staying entirely on the Azure backbone network—never traversing the public internet. On the AZ-104 exam, this scenario tests your understanding of the critical difference between service endpoints and private endpoints: a service endpoint keeps the public endpoint accessible but restricts access to a subnet, whereas a private endpoint assigns a private IP from your VNet and removes public endpoint access entirely. A common trap is choosing a private endpoint when the requirement explicitly states the public endpoint must remain reachable. Remember the key distinction: service endpoint = subnet access via public endpoint over Azure backbone; private endpoint = private IP access with public endpoint disabled. For a quick memory tip, think “service endpoint serves the subnet through the public door.”
⚠ Common exam trap
A common mix-up: candidates confuse private endpoints with service endpoints, mistakenly thinking a private endpoint is required to keep traffic on the Azure backbone, but a private endpoint removes public endpoint access, whereas a service endpoint preserves it while still routing traffic internally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service endpoint for Microsoft.Storage.
A service endpoint for Microsoft.Storage extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to be routed over the Azure backbone network rather than the internet. This satisfies the requirement to limit access to the subnet while keeping the public endpoint reachable and traffic within Azure's infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A private endpoint for the storage account.
Why it's wrong here
A private endpoint would give the storage account a private IP and usually changes the access pattern away from the public endpoint.
When this WOULD be correct
When the requirement is to completely remove public internet access to the storage account and access it privately from a virtual network, such as for compliance or security reasons where no public endpoint is allowed.
- ✓
A service endpoint for Microsoft.Storage.
Why this is correct
A service endpoint extends the subnet's identity to the storage service and keeps traffic on the Azure backbone while still using the storage account's public endpoint. This fits when the organization wants network restriction by subnet without introducing a private IP for the service. The storage firewall can then allow only the selected subnet.
- ✗
A site-to-site VPN connection to the storage account.
Why it's wrong here
VPN connects networks, not individual PaaS service access paths, and is unnecessary here.
When this WOULD be correct
A company has an on-premises network that needs secure access to an Azure virtual network and resources like storage accounts, and the traffic must traverse the internet encrypted. A site-to-site VPN would be the correct feature to establish a secure connection between the on-premises network and Azure.
- ✗
An application security group assigned to the storage account.
Why it's wrong here
Application security groups are for NICs in NSG rules, not for securing Azure Storage.
When this WOULD be correct
An ASG would be correct in a scenario where you need to apply network security group (NSG) rules to a group of VMs based on their application role, such as allowing web servers to communicate only with database servers, without using IP addresses.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A service endpoint for Microsoft.Storage.Correct answer▾
Why this is correct
A service endpoint extends the subnet's identity to the storage service and keeps traffic on the Azure backbone while still using the storage account's public endpoint. This fits when the organization wants network restriction by subnet without introducing a private IP for the service. The storage firewall can then allow only the selected subnet.
✗A private endpoint for the storage account.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint assigns the storage account a private IP from the subnet, removing public endpoint access entirely, which contradicts the requirement that the storage account remain reachable through its public endpoint.
★ When this WOULD be the correct answer
When the requirement is to completely remove public internet access to the storage account and access it privately from a virtual network, such as for compliance or security reasons where no public endpoint is allowed.
Why candidates choose this
Candidates often confuse private endpoints with service endpoints, thinking both restrict access to a subnet, but private endpoints eliminate public access, which is not what the question asks.
✗A site-to-site VPN connection to the storage account.Wrong answer — click to see why▾
Why this is wrong here
A site-to-site VPN connects on-premises networks to Azure, not a subnet to a storage account, and it routes traffic over the internet or VPN gateway, not ensuring traffic stays on the Azure backbone.
★ When this WOULD be the correct answer
A company has an on-premises network that needs secure access to an Azure virtual network and resources like storage accounts, and the traffic must traverse the internet encrypted. A site-to-site VPN would be the correct feature to establish a secure connection between the on-premises network and Azure.
Why candidates choose this
Candidates may think a VPN provides secure, private access to Azure resources, but they overlook that the question requires traffic to stay on the Azure backbone and be limited to a specific subnet, which a VPN does not achieve.
✗An application security group assigned to the storage account.Wrong answer — click to see why▾
Why this is wrong here
An application security group (ASG) is used to group virtual machines and apply network security rules based on that group, not to restrict access to a storage account from a subnet. It cannot limit traffic to the Azure backbone or provide subnet-level access control to a storage account's public endpoint.
★ When this WOULD be the correct answer
An ASG would be correct in a scenario where you need to apply network security group (NSG) rules to a group of VMs based on their application role, such as allowing web servers to communicate only with database servers, without using IP addresses.
Why candidates choose this
Candidates may confuse ASGs with service endpoints or think that ASGs can be used to secure outbound traffic to Azure services, because both involve network security and Azure resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which feature should you enable so the subnet can access the storage account without creating a private IP address in the VNet?
medium- A.Private endpoint
- ✓ B.Service endpoint
- C.VPN Gateway
- D.Azure Firewall
Why B: Service endpoints allow a subnet to securely and privately connect to Azure PaaS services (like Storage Accounts) over the Azure backbone network without requiring a private IP address in the VNet. They extend the VNet identity to the service, enabling access via the service's public endpoint while restricting traffic to the subnet. This matches the requirement exactly: no private IP is created in the VNet, and the storage account is accessed directly.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.