Inventory every storage destination before associating a service endpoint policy

Source facts

Azure service endpoint policies filter access to specific resources through service endpoints. Microsoft’s Storage tutorial warns that, after subnet association, only allowlisted resources remain accessible over that path, and the restriction applies to Storage resources in all regions.

The same warning requires all accessed resources to be included before association and says the subnet must not contain managed Azure services. This is a subnet-side restriction, separate from the tutorial’s storage-account network-access configuration. Microsoft Learn.

Applicability

Identify the subnet, existing service-endpoint use and required storage accounts in every relevant region. Treat authentication and account-side network rules as additional checks, not as substitutes for the subnet policy review.

DSE recommendation

DSE recommends building the allowlist from observed and owner-confirmed dependencies, including recovery and maintenance paths. Review the subnet for managed-service use before proposing association. Have owners approve both the required destinations and a deliberately excluded test destination. Do not assume an account outside the pilot region is unaffected, or broaden the allowlist without resolving the reason for a failed request.

Verification

During an approved test, access each required destination through the intended service-endpoint path and confirm the excluded destination is denied. Retain the policy definition, subnet association and actual account identities with the results. If a required dependency fails, compare it with the allowlist and other access controls before accepting the change. Keep a reviewed recovery plan for restoring the prior connectivity state.

Official references

Microsoft Learn: Create and associate service endpoint policies. Source retrieved September 9, 2026.