Key points

• Controls public network access and selected network or IP admission.
• Service endpoints can identify authorized subnets at the public service endpoint.
• Private endpoints add private IP paths but public access must be configured separately.

Best-known use cases

• Restrict a storage account to selected application networks.
• Make a storage service reachable through Private Link.

What candidates often confuse it with

• Storage firewall vs RBAC: network admission vs data authorization.
• Service endpoint vs private endpoint: subnet identity to public service vs private IP to one resource.

Key takeaway

Require both an allowed network path and valid data authorization for every storage request.

Related services

• Azure Storage authorization and shared access signatures
• Azure Files

Relevant exam tasks

• D2.1.S1 — Configure Azure Storage firewalls and virtual networks
• D2.1.S2 — Create and use shared access signature (SAS) tokens
• D2.1.S3 — Configure stored access policies
• D2.1.S4 — Manage access keys
• D2.1.S5 — Configure identity-based access for Azure Files

Learn more

• Azure Storage network security documentation