{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/",
        "slug": "dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/"
        },
        "title": "Include the private endpoint in an Azure Files site-to-site VPN plan",
        "summary": "DSE recommends drawing the complete client-to-share path before treating the VPN as ready.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:33:16+00:00",
        "modified_at": "2026-09-17T16:42:35+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 212,
        "potentially_affected": "This review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.",
        "dse_recommendation": "DSE recommends drawing the complete client-to-share path before treating the VPN as ready.",
        "primary_source": {
            "name": "Configure a Site-to-Site VPN for Azure Files | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft’s site-to-site procedure requires a storage-account private endpoint in the virtual network used by VPN Gateway. That endpoint supplies a private IP address for on-premises clients to reach Azure Files through the VPN tunnel. The procedure covers direct mounts of classic file shares; it directs Azure File Sync traffic configuration to separate guidance. <a href=\"https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a></p>\n<h2>Applicability</h2>\n<p>This review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends drawing the complete client-to-share path before treating the VPN as ready. Record the on-premises client network, VPN gateway virtual network, storage account, private endpoint, and intended share. Assign owners for name resolution and routing checks, and distinguish direct file access from File Sync traffic in the request. Confirm that the selected share belongs to the documented classic-resource model before following this procedure.</p>\n<h2>Verification</h2>\n<p>From an approved on-premises test client, inspect the resolved destination and verify that the intended share can be reached through the planned path. Compare the endpoint and virtual network identifiers with the design. Record a successful tunnel separately from a successful file-access test, and investigate any mismatch before completing the handoff.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft: Configure a Site-to-Site VPN for Azure Files | Microsoft Learn</a></li>\n</ul>",
        "content_text": "Source facts\nMicrosoft’s site-to-site procedure requires a storage-account private endpoint in the virtual network used by VPN Gateway. That endpoint supplies a private IP address for on-premises clients to reach Azure Files through the VPN tunnel. The procedure covers direct mounts of classic file shares; it directs Azure File Sync traffic configuration to separate guidance. Microsoft Learn\nApplicability\nThis review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.\nDSE recommendation\nDSE recommends drawing the complete client-to-share path before treating the VPN as ready. Record the on-premises client network, VPN gateway virtual network, storage account, private endpoint, and intended share. Assign owners for name resolution and routing checks, and distinguish direct file access from File Sync traffic in the request. Confirm that the selected share belongs to the documented classic-resource model before following this procedure.\nVerification\nFrom an approved on-premises test client, inspect the resolved destination and verify that the intended share can be reached through the planned path. Compare the endpoint and virtual network identifiers with the design. Record a successful tunnel separately from a successful file-access test, and investigate any mismatch before completing the handoff.\nOfficial references\n\nMicrosoft: Configure a Site-to-Site VPN for Azure Files | Microsoft Learn",
        "content_markdown": "## Source facts\n\nMicrosoft’s site-to-site procedure requires a storage-account private endpoint in the virtual network used by VPN Gateway. That endpoint supplies a private IP address for on-premises clients to reach Azure Files through the VPN tunnel. The procedure covers direct mounts of classic file shares; it directs Azure File Sync traffic configuration to separate guidance. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn)\n\n## Applicability\n\nThis review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.\n\n## DSE recommendation\n\nDSE recommends drawing the complete client-to-share path before treating the VPN as ready. Record the on-premises client network, VPN gateway virtual network, storage account, private endpoint, and intended share. Assign owners for name resolution and routing checks, and distinguish direct file access from File Sync traffic in the request. Confirm that the selected share belongs to the documented classic-resource model before following this procedure.\n\n## Verification\n\nFrom an approved on-premises test client, inspect the resolved destination and verify that the intended share can be reached through the planned path. Compare the endpoint and virtual network identifiers with the design. Record a successful tunnel separately from a successful file-access test, and investigate any mismatch before completing the handoff.\n\n## Official references\n\n- [Microsoft: Configure a Site-to-Site VPN for Azure Files | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn)"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Include the private endpoint in an Azure Files site-to-site VPN plan",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/",
                "headline": "Include the private endpoint in an Azure Files site-to-site VPN plan",
                "description": "DSE recommends drawing the complete client-to-share path before treating the VPN as ready.",
                "abstract": "DSE recommends drawing the complete client-to-share path before treating the VPN as ready.",
                "articleBody": "Source facts\nMicrosoft’s site-to-site procedure requires a storage-account private endpoint in the virtual network used by VPN Gateway. That endpoint supplies a private IP address for on-premises clients to reach Azure Files through the VPN tunnel. The procedure covers direct mounts of classic file shares; it directs Azure File Sync traffic configuration to separate guidance. Microsoft Learn\nApplicability\nThis review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.\nDSE recommendation\nDSE recommends drawing the complete client-to-share path before treating the VPN as ready. Record the on-premises client network, VPN gateway virtual network, storage account, private endpoint, and intended share. Assign owners for name resolution and routing checks, and distinguish direct file access from File Sync traffic in the request. Confirm that the selected share belongs to the documented classic-resource model before following this procedure.\nVerification\nFrom an approved on-premises test client, inspect the resolved destination and verify that the intended share can be reached through the planned path. Compare the endpoint and virtual network identifiers with the design. Record a successful tunnel separately from a successful file-access test, and investigate any mismatch before completing the handoff.\nOfficial references\n\nMicrosoft: Configure a Site-to-Site VPN for Azure Files | Microsoft Learn",
                "datePublished": "2026-09-17T16:33:16+00:00",
                "dateModified": "2026-09-17T16:42:35+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Include the private endpoint in an Azure Files site-to-site VPN plan"
                },
                "articleSection": [
                    "IT"
                ],
                "keywords": [
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 212,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Configure a Site-to-Site VPN for Azure Files | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn"
                }
            }
        ]
    }
}