For VM diagnostics agent, we create SA, if the SA is not publicly allowed, do we need to create Private end point for both Blob and Table for this SA?

Question

As per this Microsoft documentation the VM uses both blob and table for storing the diagnostic logs.

As described here that the StorageType can be Table, Blob, or TableAndBlob. And let say we are using TableAndBlob.

The storage account that we are creating for this purpose will only be accessible via private endpoints. So do, I need to create private endpoint for both blob and table with private DNS zones privatelink.blob.core.windows.net and privatelink.table.core.windows.net?

Also, if I choose StorageType as Table, I just need the table(privatelink.table.core.windows.net) private endpoint?

Imran · Answer

I tried to reproduce the same in my environment public access does not allow in the traffic. we can able to create a private endpoint for both blob and table as shown below:

enter image description here

In your storage account -> networking under Security + networking ->private endpoint connection -> create

Make sure in Firewalls and virtual networks try to enable Allow Azure services on the trusted services list to access this storage account. as below enter image description here

while creating Private endpoint connection in a target sub resource you can able to create a blob and table as below.

enter image description here

And DNS also automatically created in Private endpoint connection as privatelink.blob.core.windows.net and i have created for both blob and table.

enter image description here

You can check on your DNS configuration under setting once you click on your table or blob.

enter image description here

Additionally, you can connect in azure account through storage explore to get access storage account -> right click connect -> next

enter image description here

You can make use of Azure Private Link for storage Accounts through virtual network

For VM diagnostics agent, we create SA, if the SA is not publicly allowed, do we need to create Private end point for both Blob and Table for this SA?

1 Answers