Include the private endpoint in an Azure Files site-to-site VPN plan

Source facts

Microsoft’s site-to-site procedure requires a storage-account private endpoint in the virtual network used by VPN Gateway. That endpoint supplies a private IP address for on-premises clients to reach Azure Files through the VPN tunnel. The procedure covers direct mounts of classic file shares; it directs Azure File Sync traffic configuration to separate guidance. Microsoft Learn

Applicability

This review applies to direct on-premises mounting of classic Azure Files shares through a site-to-site VPN, within the source’s documented resource-provider scope.

DSE recommendation

DSE recommends drawing the complete client-to-share path before treating the VPN as ready. Record the on-premises client network, VPN gateway virtual network, storage account, private endpoint, and intended share. Assign owners for name resolution and routing checks, and distinguish direct file access from File Sync traffic in the request. Confirm that the selected share belongs to the documented classic-resource model before following this procedure.

Verification

From an approved on-premises test client, inspect the resolved destination and verify that the intended share can be reached through the planned path. Compare the endpoint and virtual network identifiers with the design. Record a successful tunnel separately from a successful file-access test, and investigate any mismatch before completing the handoff.

Official references

• Microsoft: Configure a Site-to-Site VPN for Azure Files | Microsoft Learn