# Include the private endpoint in an Azure Files site-to-site VPN plan

> DSE recommends drawing the complete client-to-share path before treating the VPN as ready.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:16+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends drawing the complete client-to-share path before treating the VPN as ready.

## Potentially affected

This review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.

## DSE recommendation

DSE recommends drawing the complete client-to-share path before treating the VPN as ready.

## Article

## Source facts

Microsoft’s site-to-site procedure requires a storage-account private endpoint in the virtual network used by VPN Gateway. That endpoint supplies a private IP address for on-premises clients to reach Azure Files through the VPN tunnel. The procedure covers direct mounts of classic file shares; it directs Azure File Sync traffic configuration to separate guidance. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn)

## Applicability

This review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.

## DSE recommendation

DSE recommends drawing the complete client-to-share path before treating the VPN as ready. Record the on-premises client network, VPN gateway virtual network, storage account, private endpoint, and intended share. Assign owners for name resolution and routing checks, and distinguish direct file access from File Sync traffic in the request. Confirm that the selected share belongs to the documented classic-resource model before following this procedure.

## Verification

From an approved on-premises test client, inspect the resolved destination and verify that the intended share can be reached through the planned path. Compare the endpoint and virtual network identifiers with the design. Record a successful tunnel separately from a successful file-access test, and investigate any mismatch before completing the handoff.

## Official references

- [Microsoft: Configure a Site-to-Site VPN for Azure Files | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn)

## Primary reference

- Name: Configure a Site-to-Site VPN for Azure Files | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-configure-s2s-vpn
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Include the private endpoint in an Azure Files site-to-site VPN plan,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-104-include-the-private-endpoint-in-an-azure-files-site-to-site-vpn-plan/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.