{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/", "slug": "dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review", "url": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/" }, "title": "Include File Sync's paired-region destinations in a GRS firewall review", "summary": "Review File Sync regional and discovery destinations against the storage redundancy choice.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:37+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 221, "potentially_affected": "Azure File Sync servers connected to geo-redundant Azure storage accounts.", "dse_recommendation": "Check primary-region, paired-region, and discovery destinations together before accepting the File Sync allowlist.", "primary_source": { "name": "Azure File Sync on-premises firewall and proxy settings | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-firewall-and-proxy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For public-cloud File Sync service endpoints, Microsoft distinguishes storage redundancy choices. LRS and ZRS use the listed primary endpoint; GRS requires the primary region’s endpoint, its paired region’s endpoint, and the region’s discovery URL.

\n

After server registration, Test-StorageSyncNetworkConnectivity and ServerRegistration.exe can test communications with that server’s service endpoints. These checks help identify incomplete proxy or firewall access. Microsoft Learn.

\n

Applicability

\n

Identify the storage account’s actual redundancy configuration and the Storage Sync Service region. Use the current table for the correct Azure cloud. Treat the regional service list as one part of the complete File Sync network requirements, not the entire dependency inventory.

\n

DSE recommendation

\n

DSE recommends recording each required destination alongside its role: primary service, paired-region service, or discovery. Ask the firewall owner to reconcile explicit entries with the deployed region rather than copying another server’s allowlist. Include a review trigger for region, redundancy, proxy, or endpoint-policy changes, and retain the previous rules.

\n

Verification

\n

Run the documented endpoint test from the registered server and preserve the per-destination results. Investigate any blocked paired-region or discovery destination even when routine synchronization appears healthy. Recheck after approved firewall changes. Record this as connectivity evidence only; schedule a separate recovery exercise if recovery behavior must be proven.

\n

Official references

\n

Microsoft Learn: Azure File Sync on-premises firewall and proxy settings. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor public-cloud File Sync service endpoints, Microsoft distinguishes storage redundancy choices. LRS and ZRS use the listed primary endpoint; GRS requires the primary region’s endpoint, its paired region’s endpoint, and the region’s discovery URL.\nAfter server registration, Test-StorageSyncNetworkConnectivity and ServerRegistration.exe can test communications with that server’s service endpoints. These checks help identify incomplete proxy or firewall access. Microsoft Learn.\nApplicability\nIdentify the storage account’s actual redundancy configuration and the Storage Sync Service region. Use the current table for the correct Azure cloud. Treat the regional service list as one part of the complete File Sync network requirements, not the entire dependency inventory.\nDSE recommendation\nDSE recommends recording each required destination alongside its role: primary service, paired-region service, or discovery. Ask the firewall owner to reconcile explicit entries with the deployed region rather than copying another server’s allowlist. Include a review trigger for region, redundancy, proxy, or endpoint-policy changes, and retain the previous rules.\nVerification\nRun the documented endpoint test from the registered server and preserve the per-destination results. Investigate any blocked paired-region or discovery destination even when routine synchronization appears healthy. Recheck after approved firewall changes. Record this as connectivity evidence only; schedule a separate recovery exercise if recovery behavior must be proven.\nOfficial references\nMicrosoft Learn: Azure File Sync on-premises firewall and proxy settings. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor public-cloud File Sync service endpoints, Microsoft distinguishes storage redundancy choices. LRS and ZRS use the listed primary endpoint; GRS requires the primary region’s endpoint, its paired region’s endpoint, and the region’s discovery URL.\n\nAfter server registration, Test-StorageSyncNetworkConnectivity and ServerRegistration.exe can test communications with that server’s service endpoints. These checks help identify incomplete proxy or firewall access. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-firewall-and-proxy).\n\n## Applicability\n\nIdentify the storage account’s actual redundancy configuration and the Storage Sync Service region. Use the current table for the correct Azure cloud. Treat the regional service list as one part of the complete File Sync network requirements, not the entire dependency inventory.\n\n## DSE recommendation\n\nDSE recommends recording each required destination alongside its role: primary service, paired-region service, or discovery. Ask the firewall owner to reconcile explicit entries with the deployed region rather than copying another server’s allowlist. Include a review trigger for region, redundancy, proxy, or endpoint-policy changes, and retain the previous rules.\n\n## Verification\n\nRun the documented endpoint test from the registered server and preserve the per-destination results. Investigate any blocked paired-region or discovery destination even when routine synchronization appears healthy. Recheck after approved firewall changes. Record this as connectivity evidence only; schedule a separate recovery exercise if recovery behavior must be proven.\n\n## Official references\n\n[Microsoft Learn: Azure File Sync on-premises firewall and proxy settings](https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-firewall-and-proxy). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/", "url": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Include File Sync's paired-region destinations in a GRS firewall review", "item": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/", "url": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/", "headline": "Include File Sync's paired-region destinations in a GRS firewall review", "description": "Review File Sync regional and discovery destinations against the storage redundancy choice.", "abstract": "Review File Sync regional and discovery destinations against the storage redundancy choice.", "articleBody": "Source facts\nFor public-cloud File Sync service endpoints, Microsoft distinguishes storage redundancy choices. LRS and ZRS use the listed primary endpoint; GRS requires the primary region’s endpoint, its paired region’s endpoint, and the region’s discovery URL.\nAfter server registration, Test-StorageSyncNetworkConnectivity and ServerRegistration.exe can test communications with that server’s service endpoints. These checks help identify incomplete proxy or firewall access. Microsoft Learn.\nApplicability\nIdentify the storage account’s actual redundancy configuration and the Storage Sync Service region. Use the current table for the correct Azure cloud. Treat the regional service list as one part of the complete File Sync network requirements, not the entire dependency inventory.\nDSE recommendation\nDSE recommends recording each required destination alongside its role: primary service, paired-region service, or discovery. Ask the firewall owner to reconcile explicit entries with the deployed region rather than copying another server’s allowlist. Include a review trigger for region, redundancy, proxy, or endpoint-policy changes, and retain the previous rules.\nVerification\nRun the documented endpoint test from the registered server and preserve the per-destination results. Investigate any blocked paired-region or discovery destination even when routine synchronization appears healthy. Recheck after approved firewall changes. Record this as connectivity evidence only; schedule a separate recovery exercise if recovery behavior must be proven.\nOfficial references\nMicrosoft Learn: Azure File Sync on-premises firewall and proxy settings. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:31:37+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-019-include-file-sync-s-paired-region-destinations-in-a-grs-firewall-review/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Include File Sync's paired-region destinations in a GRS firewall review" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 221, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure File Sync on-premises firewall and proxy settings | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-firewall-and-proxy" } } ] } }