Include File Sync's paired-region destinations in a GRS firewall review

Source facts

For public-cloud File Sync service endpoints, Microsoft distinguishes storage redundancy choices. LRS and ZRS use the listed primary endpoint; GRS requires the primary region’s endpoint, its paired region’s endpoint, and the region’s discovery URL.

After server registration, Test-StorageSyncNetworkConnectivity and ServerRegistration.exe can test communications with that server’s service endpoints. These checks help identify incomplete proxy or firewall access. Microsoft Learn.

Applicability

Identify the storage account’s actual redundancy configuration and the Storage Sync Service region. Use the current table for the correct Azure cloud. Treat the regional service list as one part of the complete File Sync network requirements, not the entire dependency inventory.

DSE recommendation

DSE recommends recording each required destination alongside its role: primary service, paired-region service, or discovery. Ask the firewall owner to reconcile explicit entries with the deployed region rather than copying another server’s allowlist. Include a review trigger for region, redundancy, proxy, or endpoint-policy changes, and retain the previous rules.

Verification

Run the documented endpoint test from the registered server and preserve the per-destination results. Investigate any blocked paired-region or discovery destination even when routine synchronization appears healthy. Recheck after approved firewall changes. Record this as connectivity evidence only; schedule a separate recovery exercise if recovery behavior must be proven.

Official references

Microsoft Learn: Azure File Sync on-premises firewall and proxy settings. Source retrieved September 9, 2026.