Remediate from Azure Portal Open the Storage Accounts blade For each listed Storage Account, perform the following: Under the Security + networking heading, click on Networking Click on the Private endpoint connections tab at the top of the networking window Click the + Private endpoint button In the 1 - Basics tab/step: Enter a name that will be easily recognizable as associated with the Storage Account (Note: The 'Network Interface Name' will be automatically completed, but you can customize it if needed.) Ensure that the Region matches the region of the Storage Account Click Next In the 2 - Resource tab/step: Select the target sub-resource based on what type of storage resource is being made available Click Next In the 3 - Virtual Network tab/step: Select the Virtual network that your Storage Account will be connecting to Select the Subnet that your Storage Account will be connecting to (Optional) Select other network settings as appropriate for your environment Click Next In the 4 - DNS tab/step: (Optional) Select other DNS settings as appropriate for your environment Click Next In the 5 - Tags tab/step: (Optional) Set any tags that are relevant to your organization Click Next In the 6 - Review + create tab/step: A validation attempt will be made and after a few moments it should indicate Validation Passed - if it does not pass, double-check your settings before beginning more in depth troubleshooting. If validation has passed, click Create then wait for a few minutes for the scripted deployment to complete. Repeat the above procedure for each Private Endpoint required within every Storage Account. Remediate from PowerShell $storageAccount = Get-AzStorageAccount -ResourceGroupName '' -Name '' $privateEndpointConnection = @{ Name = 'connectionName' PrivateLinkServiceId = $storageAccount.Id GroupID = 'blob|blob_secondary|file|file_secondary|table|table_secondary|queue|queue_secondary|web|web_secondary|dfs|dfs_secondary' } $privateLinkServiceConnection = New-AzPrivateLinkServiceConnection @privateEndpointConnection $virtualNetDetails = Get-AzVirtualNetwork -ResourceGroupName '' -Name '' $privateEndpoint = @{ ResourceGroupName = '' Name = '' Location = '' Subnet = $virtualNetDetails.Subnets[0] PrivateLinkServiceConnection = $privateLinkServiceConnection } New-AzPrivateEndpoint @privateEndpoint Remediate from Azure CLI az network private-endpoint create --resource-group --name --vnet-name --subnet --private-connection-resource-id --connection-name --group-id Default Value: By default, Private Endpoints are not created for Storage Accounts.

Detections

Analytics

Item Search