In this lab, we configure a service endpoint that allows direct and non-public communications between virtual machines running in Azure and blobs within a storage account. The lab starts with a pre-created Windows Server VM / associated virtual network, and also a pre-created storage account. We then configure a service endpoint from the VM’s virtual network to the storage account. The service endpoint is then established by going to the virtual network and opening the ‘Service endpoints’ page, where we then establish the connectivity.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Log in to the Azure Portal
Log in to the Azure Portal using the username and password supplied by the lab:
- Open a browser.
- Navigate to the provided Azure Portal URL.
- Use the supplied username and password to authenticate.
- Go to the VM’s virtual network page
- Navigate to the virtual networks page in the portal
- Select the virtual network named lab-VN
- Configure the service endpoint
From the lab-VN page, perform the following:
- Click the Service endpoints link/menu item.
- Click the + Add button at the top of the form that opens.
A panel will open on the right side of the portal with the title Add service endpoints. In that panel:
- In the Service drop-down, select Microsoft.Storage
- Do not change the options for Service endpoint policies
- Under subnets, select default
- Click the Add button at the bottom of the page.
The panel will close, and after a few seconds, you will see a service endpoint named Microsoft.Storage appears.
We need to connect the service endpoint to the storage account.- Click on the … on the default subnet.
- On the menu that pops up, click on Configure virtual network…
This will open a list of the available storage accounts. In this lab, there will only be one. Let’s go to it.
- Click on the storage account to be taken to its overview
Now let’s configure the storage account to only allow connectivity to the default subnet:
- In the menu, click on Firewalls and virtual networks.
- Click on the Selected networks radio button.
The form will reconfigure, and you will see an empty list of Virtual networks:
- Click on the Add existing virtual network link.
- A panel will open. Under virtual networks select lab-VN.
- Under subnets, select default.
- Click the Add button.
- Back on the Firewalls and networks form, click the Save button.
After a moment, the firewall will be configured, and traffic from your virtual network will be routed across the Azure backbone (and not the Internet), and other sources will be blocked.
