{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/", "slug": "dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths", "url": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/" }, "title": "Secure both File Sync resources before closing their public paths", "summary": "A storage account service endpoint does not provide an equivalent restriction for the separate Storage Sync Service.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:38+00:00", "modified_at": "2026-09-10T01:23:48+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 231, "potentially_affected": "Azure File Sync deployments changing storage-account and Storage Sync Service network access.", "dse_recommendation": "Review the two resource endpoints separately and establish the Storage Sync Service private path before disabling its public endpoint.", "primary_source": { "name": "Configure Azure File Sync network endpoints | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-networking-endpoints", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure File Sync communicates with two separate resources: the storage account holding the share and the Storage Sync Service coordinating synchronization. Each has its own network endpoints.

\n

Storage accounts can restrict a public endpoint with service endpoints, but Storage Sync Service does not support that model. Its VNet restriction uses private endpoints. Microsoft requires creating a private endpoint before disabling its public endpoint, otherwise sync cannot work. Microsoft Learn.

\n

Applicability

\n

Inventory both resources, their endpoint configuration and the agent’s route and name-resolution path. Do not use a successful share connection as the only evidence that the coordination service remains reachable.

\n

DSE recommendation

\n

DSE recommends a two-resource network change record with separate readiness checks and rollback decisions. Establish and test the intended private path before removing public access. Coordinate storage, network and file-service owners, and preserve the prior endpoint settings for comparison. Keep the resource names explicit so an operator cannot mistakenly apply a storage-account procedure to Storage Sync Service.

\n

Verification

\n

From the approved agent location, check resolution and connectivity for each resource and perform a harmless end-to-end synchronization test. Compare behavior before and after the authorized public-access change. Verify the intended restricted path and investigate any fallback or coordination failure. Retain both endpoint configurations and the observed synchronization result before extending the change to additional deployments.

\n

Official references

\n

Microsoft Learn: Configure Azure File Sync network endpoints. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure File Sync communicates with two separate resources: the storage account holding the share and the Storage Sync Service coordinating synchronization. Each has its own network endpoints.\nStorage accounts can restrict a public endpoint with service endpoints, but Storage Sync Service does not support that model. Its VNet restriction uses private endpoints. Microsoft requires creating a private endpoint before disabling its public endpoint, otherwise sync cannot work. Microsoft Learn.\nApplicability\nInventory both resources, their endpoint configuration and the agent’s route and name-resolution path. Do not use a successful share connection as the only evidence that the coordination service remains reachable.\nDSE recommendation\nDSE recommends a two-resource network change record with separate readiness checks and rollback decisions. Establish and test the intended private path before removing public access. Coordinate storage, network and file-service owners, and preserve the prior endpoint settings for comparison. Keep the resource names explicit so an operator cannot mistakenly apply a storage-account procedure to Storage Sync Service.\nVerification\nFrom the approved agent location, check resolution and connectivity for each resource and perform a harmless end-to-end synchronization test. Compare behavior before and after the authorized public-access change. Verify the intended restricted path and investigate any fallback or coordination failure. Retain both endpoint configurations and the observed synchronization result before extending the change to additional deployments.\nOfficial references\nMicrosoft Learn: Configure Azure File Sync network endpoints. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure File Sync communicates with two separate resources: the storage account holding the share and the Storage Sync Service coordinating synchronization. Each has its own network endpoints.\n\nStorage accounts can restrict a public endpoint with service endpoints, but Storage Sync Service does not support that model. Its VNet restriction uses private endpoints. Microsoft requires creating a private endpoint before disabling its public endpoint, otherwise sync cannot work. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-networking-endpoints).\n\n## Applicability\n\nInventory both resources, their endpoint configuration and the agent’s route and name-resolution path. Do not use a successful share connection as the only evidence that the coordination service remains reachable.\n\n## DSE recommendation\n\nDSE recommends a two-resource network change record with separate readiness checks and rollback decisions. Establish and test the intended private path before removing public access. Coordinate storage, network and file-service owners, and preserve the prior endpoint settings for comparison. Keep the resource names explicit so an operator cannot mistakenly apply a storage-account procedure to Storage Sync Service.\n\n## Verification\n\nFrom the approved agent location, check resolution and connectivity for each resource and perform a harmless end-to-end synchronization test. Compare behavior before and after the authorized public-access change. Verify the intended restricted path and investigate any fallback or coordination failure. Retain both endpoint configurations and the observed synchronization result before extending the change to additional deployments.\n\n## Official references\n\n[Microsoft Learn: Configure Azure File Sync network endpoints](https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-networking-endpoints). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/", "url": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Secure both File Sync resources before closing their public paths", "item": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/", "url": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/", "headline": "Secure both File Sync resources before closing their public paths", "description": "A storage account service endpoint does not provide an equivalent restriction for the separate Storage Sync Service.", "abstract": "A storage account service endpoint does not provide an equivalent restriction for the separate Storage Sync Service.", "articleBody": "Source facts\nAzure File Sync communicates with two separate resources: the storage account holding the share and the Storage Sync Service coordinating synchronization. Each has its own network endpoints.\nStorage accounts can restrict a public endpoint with service endpoints, but Storage Sync Service does not support that model. Its VNet restriction uses private endpoints. Microsoft requires creating a private endpoint before disabling its public endpoint, otherwise sync cannot work. Microsoft Learn.\nApplicability\nInventory both resources, their endpoint configuration and the agent’s route and name-resolution path. Do not use a successful share connection as the only evidence that the coordination service remains reachable.\nDSE recommendation\nDSE recommends a two-resource network change record with separate readiness checks and rollback decisions. Establish and test the intended private path before removing public access. Coordinate storage, network and file-service owners, and preserve the prior endpoint settings for comparison. Keep the resource names explicit so an operator cannot mistakenly apply a storage-account procedure to Storage Sync Service.\nVerification\nFrom the approved agent location, check resolution and connectivity for each resource and perform a harmless end-to-end synchronization test. Compare behavior before and after the authorized public-access change. Verify the intended restricted path and investigate any fallback or coordination failure. Retain both endpoint configurations and the observed synchronization result before extending the change to additional deployments.\nOfficial references\nMicrosoft Learn: Configure Azure File Sync network endpoints. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:38+00:00", "dateModified": "2026-09-10T01:23:48+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-258-secure-both-file-sync-resources-before-closing-their-public-paths/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Secure both File Sync resources before closing their public paths" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 231, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Azure File Sync network endpoints | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-networking-endpoints" } } ] } }