Trusted Azure services

If you need to enable traffic from an Azure service outside of your network boundary, you can add a network security exception. This is useful when an Azure service operates from a network that you can't include in your virtual network or IP network rules. For example, some services might need to read resource logs and metrics in your account. You can allow read access for log files, metrics tables, or both by creating a network rule exception. These services connect to your storage account using strong authentication.

To learn how to add a network security exception, see Manage Network security exceptions.

Trusted access for resources registered in your Microsoft Entra tenant

Resources from some services can access your storage account for selected operations, such as writing logs or running backups. These services must be registered in a subscription that is located in the same Microsoft Entra tenant as your storage account. The following table describes each service and its allowed operations.

Trusted access based on a managed identity

The following table lists services that can access your storage account data if the resource instances of those services have the appropriate permissions.

If your account doesn't have the hierarchical namespace feature enabled, you can grant permission by explicitly assigning an Azure role to the managed identity for each resource instance. In this case, the scope of access for the instance corresponds to the Azure role assigned to the managed identity.

You can use the same technique for an account that has the hierarchical namespace feature enabled. However, you don't have to assign an Azure role if you add the managed identity to the access control list (ACL) of any directory or blob that the storage account contains. In that case, the scope of access for the instance corresponds to the directory or file to which the managed identity has access.

You can also combine Azure roles and ACLs together to grant access. To learn more, see Access control model in Azure Data Lake Storage.

We recommend that you use resource instance rules to grant access to specific resources.

See also

• Azure Storage firewall and virtual network rules
• Manage Network security exceptions