{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/", "slug": "dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy", "url": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/" }, "title": "Inventory every storage destination before associating a service endpoint policy", "summary": "The subnet's new allowlist affects Azure Storage service-endpoint access across regions, not only the account used in a pilot.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:57+00:00", "modified_at": "2026-09-10T01:23:49+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 246, "potentially_affected": "Virtual-network subnets accessing Azure Storage through service endpoints.", "dse_recommendation": "Review all required storage destinations and managed-service dependencies before binding the subnet to an allowlist.", "primary_source": { "name": "Create and associate service endpoint policies | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure service endpoint policies filter access to specific resources through service endpoints. Microsoft’s Storage tutorial warns that, after subnet association, only allowlisted resources remain accessible over that path, and the restriction applies to Storage resources in all regions.

\n

The same warning requires all accessed resources to be included before association and says the subnet must not contain managed Azure services. This is a subnet-side restriction, separate from the tutorial’s storage-account network-access configuration. Microsoft Learn.

\n

Applicability

\n

Identify the subnet, existing service-endpoint use and required storage accounts in every relevant region. Treat authentication and account-side network rules as additional checks, not as substitutes for the subnet policy review.

\n

DSE recommendation

\n

DSE recommends building the allowlist from observed and owner-confirmed dependencies, including recovery and maintenance paths. Review the subnet for managed-service use before proposing association. Have owners approve both the required destinations and a deliberately excluded test destination. Do not assume an account outside the pilot region is unaffected, or broaden the allowlist without resolving the reason for a failed request.

\n

Verification

\n

During an approved test, access each required destination through the intended service-endpoint path and confirm the excluded destination is denied. Retain the policy definition, subnet association and actual account identities with the results. If a required dependency fails, compare it with the allowlist and other access controls before accepting the change. Keep a reviewed recovery plan for restoring the prior connectivity state.

\n

Official references

\n

Microsoft Learn: Create and associate service endpoint policies. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure service endpoint policies filter access to specific resources through service endpoints. Microsoft’s Storage tutorial warns that, after subnet association, only allowlisted resources remain accessible over that path, and the restriction applies to Storage resources in all regions.\nThe same warning requires all accessed resources to be included before association and says the subnet must not contain managed Azure services. This is a subnet-side restriction, separate from the tutorial’s storage-account network-access configuration. Microsoft Learn.\nApplicability\nIdentify the subnet, existing service-endpoint use and required storage accounts in every relevant region. Treat authentication and account-side network rules as additional checks, not as substitutes for the subnet policy review.\nDSE recommendation\nDSE recommends building the allowlist from observed and owner-confirmed dependencies, including recovery and maintenance paths. Review the subnet for managed-service use before proposing association. Have owners approve both the required destinations and a deliberately excluded test destination. Do not assume an account outside the pilot region is unaffected, or broaden the allowlist without resolving the reason for a failed request.\nVerification\nDuring an approved test, access each required destination through the intended service-endpoint path and confirm the excluded destination is denied. Retain the policy definition, subnet association and actual account identities with the results. If a required dependency fails, compare it with the allowlist and other access controls before accepting the change. Keep a reviewed recovery plan for restoring the prior connectivity state.\nOfficial references\nMicrosoft Learn: Create and associate service endpoint policies. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure service endpoint policies filter access to specific resources through service endpoints. Microsoft’s Storage tutorial warns that, after subnet association, only allowlisted resources remain accessible over that path, and the restriction applies to Storage resources in all regions.\n\nThe same warning requires all accessed resources to be included before association and says the subnet must not contain managed Azure services. This is a subnet-side restriction, separate from the tutorial’s storage-account network-access configuration. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies).\n\n## Applicability\n\nIdentify the subnet, existing service-endpoint use and required storage accounts in every relevant region. Treat authentication and account-side network rules as additional checks, not as substitutes for the subnet policy review.\n\n## DSE recommendation\n\nDSE recommends building the allowlist from observed and owner-confirmed dependencies, including recovery and maintenance paths. Review the subnet for managed-service use before proposing association. Have owners approve both the required destinations and a deliberately excluded test destination. Do not assume an account outside the pilot region is unaffected, or broaden the allowlist without resolving the reason for a failed request.\n\n## Verification\n\nDuring an approved test, access each required destination through the intended service-endpoint path and confirm the excluded destination is denied. Retain the policy definition, subnet association and actual account identities with the results. If a required dependency fails, compare it with the allowlist and other access controls before accepting the change. Keep a reviewed recovery plan for restoring the prior connectivity state.\n\n## Official references\n\n[Microsoft Learn: Create and associate service endpoint policies](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/", "url": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Inventory every storage destination before associating a service endpoint policy", "item": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/", "url": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/", "headline": "Inventory every storage destination before associating a service endpoint policy", "description": "The subnet's new allowlist affects Azure Storage service-endpoint access across regions, not only the account used in a pilot.", "abstract": "The subnet's new allowlist affects Azure Storage service-endpoint access across regions, not only the account used in a pilot.", "articleBody": "Source facts\nAzure service endpoint policies filter access to specific resources through service endpoints. Microsoft’s Storage tutorial warns that, after subnet association, only allowlisted resources remain accessible over that path, and the restriction applies to Storage resources in all regions.\nThe same warning requires all accessed resources to be included before association and says the subnet must not contain managed Azure services. This is a subnet-side restriction, separate from the tutorial’s storage-account network-access configuration. Microsoft Learn.\nApplicability\nIdentify the subnet, existing service-endpoint use and required storage accounts in every relevant region. Treat authentication and account-side network rules as additional checks, not as substitutes for the subnet policy review.\nDSE recommendation\nDSE recommends building the allowlist from observed and owner-confirmed dependencies, including recovery and maintenance paths. Review the subnet for managed-service use before proposing association. Have owners approve both the required destinations and a deliberately excluded test destination. Do not assume an account outside the pilot region is unaffected, or broaden the allowlist without resolving the reason for a failed request.\nVerification\nDuring an approved test, access each required destination through the intended service-endpoint path and confirm the excluded destination is denied. Retain the policy definition, subnet association and actual account identities with the results. If a required dependency fails, compare it with the allowlist and other access controls before accepting the change. Keep a reviewed recovery plan for restoring the prior connectivity state.\nOfficial references\nMicrosoft Learn: Create and associate service endpoint policies. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:57+00:00", "dateModified": "2026-09-10T01:23:49+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-299-inventory-every-storage-destination-before-associating-a-service-endpoint-policy/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Inventory every storage destination before associating a service endpoint policy" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create and associate service endpoint policies | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies" } } ] } }