Microsoft Sentinel

Enable Network Security for Azure Storage Blob Connectors

4 September 2026Doc updateAction required+19 / −30 lines

In brief

The article adds an Overview section, guidance to create an inbound rule for required Scuba service IP ranges, and reorganized related links. Wording and metadata were also refreshed.

What Defender admins need to know

Administrators configuring this connector should add the documented inbound rule for the required Scuba service IP ranges.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Enable Network Security for Azure Storage blob connectors

Overview

This article provides step-by-step instructions on how to enable network security on the storage resources integrated with your Azure Storage connector. Azure network security perimeter (NSP) is an Azure-native feature that creates a logical isolation boundary for your PaaS resources. By associating resources like storage accounts or databases with an NSP, you can centrally manage network access using a simplified rule set. For more information, see Network security perimeter concepts.

Prerequisites

Before you begin, you must have the following Azure Storage connector resources already deployed and configured:

Azure Storage account —: The storage account integrated with your Azure Storage connector.
Azure Storage queue —: The queue that receives blob creation event notifications.
Event Grid system topic —: The system topic on the storage account that streams blob creation events to the storage queue.

If you haven't created these resources yet, see Set up your Azure Storage Connector to stream logs to Microsoft Sentinel.

Enter Name, for example storageblob-connectors-nsp
Select a Region. The region must be the same region as the storage account.
Enter a Profile name or accept the default. The profile defines the set of rules that are applied to associated resources. You can have multiple profiles within a single NSP to apply different rules to different resources if required.
Select Review + create ~~and~~, then select Create.
:::image type="content" source="./media/enable-storage-network-security/create-network-security-perimeter.png" lightbox="./media/enable-storage-network-security/create-network-security-perimeter.png" alt-text="A screenshot showing the creation of a Network Security Perimeter in the Azure portal.":::
:::image type="content" source="./media/enable-storage-network-security/select-event-system-topic.png" lightbox="./media/enable-storage-network-security/select-event-system-topic.png" alt-text="A screenshot showing the Event tab for Storage Accounts in the Azure portal.":::
Select Identity.
On the System assigned tab, set the Status to On.
Select Save, then copy the managed identity's Object ID ~~of the managed identity.~~. You need this Object ID when assigning the Storage Queue Data Message Sender role in the next section.
:::image type="content" source="./media/enable-storage-network-security/create-system-assigned-identity.png" lightbox="./media/enable-storage-network-security/create-system-assigned-identity.png" alt-text="A screenshot showing the creation of a managed identity for an Event Grid System Topic in the Azure portal.":::

Grant RBAC permissions on the Storage Queue

To grant the Event Grid system topic managed identity permission to send messages to the storage queue, perform the following steps:

Navigate to your Storage Account.
Select Access Control (IAM).
Select Add.
Search for and select the Storage Queue Data Message Sender role (scope: the storage account).
Select Review + assign to complete the role assignment. :::image type="content" source="./media/enable-storage-network-security/add-role-assignment.png" lightbox="./media/enable-storage-network-security/add-role-assignment.png" alt-text="A screenshot showing the assignment of the Storage Queue Data Message Sender role to a managed identity in the Azure portal.":::

Enable Managed Identity on the event subscription

To enable managed identity on the event subscription, perform the following steps:

Open the Event Grid System Topic.
Select the event subscription that targets the queue.
Select the Additional settings tab.
Set Managed identity type to System-assigned.

:::image type="content" source="./media/enable-storage-network-security/set-additional-features.png" lightbox="./media/enable-storage-network-security/set-additional-features.png" alt-text="A screenshot showing the enabling of managed identity for an Event Grid subscription in the Azure portal.":::

Configure Inbound Access rules on the Network Security Perimeter profile

The following rules are required to allow Event Grid to deliver messages to the storage account while blocking unauthorized access. Depending on the system sending data to the storage account or accessing the storage resources, you may need to add additional inbound rules. Review your scenario and traffic patterns to determine whether you need only the required Event Grid rules or additional inbound NSP rules, and allow time for rule propagation. Event Grid delivery doesn't originate from fixed public IPs. The NSP validates delivery using subscription identity.

Navigate to Network Security Perimeter and select your NSP.
Select Profiles and then select the profile associated with your storage account.
Select Inbound access rules and then select Add.
:::image type="content" source="./media/enable-storage-network-security/inbound-access-rules.png" lightbox="./media/enable-storage-network-security/inbound-access-rules.png" alt-text="A screenshot showing the Inbound access rules page in the Azure portal.":::
Enter a Rule name,; for ~~example~~example, Allow-Subscription.
Select Subscription from the Source type drop-down.
Select your subscription from the Allowed Sources drop-down.

Rule 2: Allow Scuba service IP ranges

Create an inbound rule that allows the Scuba service IP ranges required for this scenario.

Create a second Inbound access rules.
Enter a Rule name; for example, Allow-Scuba.
Select IP address ranges from the Source type drop-down.
Open the Download Azure service tags JSON files page.
Select your ~~cloud,~~cloud; for ~~example~~example, Azure Public.
Select the Download button and open the downloaded file to get the list of IP ranges.
Find the Scuba service tag and copy the associated IPv4 ranges.
:::image type="content" source="./media/enable-storage-network-security/scuba-ipv4-addresses.png" lightbox="./media/enable-storage-network-security/scuba-ipv4-addresses.png" alt-text="A screenshot showing a part of the ServiceTags_Public.json file with the Scuba service tag and IPv4 ranges highlighted.":::

Validate and enforce

After configuring the rules, monitor the diagnostic logs for the Network Security Perimeter to validate that legitimate traffic is allowed and there are no disruptions. Once you have confirmed that the rules are correctly allowing necessary traffic, you can switch from Transition mode to Enforced mode to block unauthorized access.

Apply Enforcement mode

Once validation is successful, set the access mode to Enforced as follows:

From the Network Security Perimeter page, under Settings, select Associated resources.
Select the storage account.
Select Change access mode.
Select Enforced and then Save. Setting the storage account to Secured by Perimeter ensures that all traffic to the storage account is evaluated against the Network Security Perimeter rules and blocks public network access.
Navigate to your Storage Account.
Under Security + networking, select Networking.
Under Public network access, select Manage.
Set Secured by Perimeter (Most restricted).

:::image type="content" source="./media/enable-storage-network-security/set-storage-networking.png" lightbox="./media/enable-storage-network-security/set-storage-networking.png" alt-text="A screenshot showing how to set a storage account to 'Secured by Perimeter' in the Azure portal.":::

Next stepsRelated content

~~In this article, you learned how to enable network security on the storage resources integrated with your Azure Storage connector. For more information, see the Network Security Perimeter articles.~~

~~Review data-connection rules in Azure Storage data connection rules reference.~~
~~Troubleshoot connector networking issues in Troubleshoot the Azure Storage Blob connector.~~ \ No newline at end of file

@@ -1,29 +1,30 @@ ----title: Enable Network Security for Azure Storage blob connectors+title: Enable Network Security for Azure Storage Blob Connectors description: Learn how to enable network security for Azure Storage connector resources. Follow step-by-step instructions to secure your storage accounts with Network Security Perimeters. ms.author: edbaynash author: EdB-MSFT ms.reviewer: krishsa-ms.date: 06/15/2026+ms.date: 07/01/2026 ms.topic: how-to ms.service: microsoft-sentinel ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #customer intent: As a security engineer, I want to configure a Network Security Perimeter for storage accounts used in storage blob connectors ---  # Enable Network Security for Azure Storage blob connectors -This article provides step-by-step instructions on how to enable network security on the storage resources integrated with your Azure Storage connector. Azure network security perimeter (NSP) is an Azure-native feature that creates a logical isolation boundary for your PaaS resources. By associating resources like storage accounts or databases with an NSP, you can centrally manage network access using a simplified rule set. For more information, see [Network security perimeter concepts](/azure/private-link/network-security-perimeter-concepts).+## Overview +This article provides step-by-step instructions on how to enable network security on the storage resources integrated with your Azure Storage connector. Azure network security perimeter (NSP) is an Azure-native feature that creates a logical isolation boundary for your PaaS resources. By associating resources like storage accounts or databases with an NSP, you can centrally manage network access using a simplified rule set. For more information, see [Network security perimeter concepts](/azure/private-link/network-security-perimeter-concepts).  ## Prerequisites  Before you begin, you must have the following Azure Storage connector resources already deployed and configured: -- **Azure Storage account** — The storage account integrated with your Azure Storage connector.-- **Azure Storage queue** — The queue that receives blob creation event notifications.-- **Event Grid system topic** — The system topic on the storage account that streams blob creation events to the storage queue.+- **Azure Storage account**: The storage account integrated with your Azure Storage connector.+- **Azure Storage queue**: The queue that receives blob creation event notifications.+- **Event Grid system topic**: The system topic on the storage account that streams blob creation events to the storage queue.  If you haven't created these resources yet, see [Set up your Azure Storage Connector to stream logs to Microsoft Sentinel](setup-azure-storage-connector.md). @@ -49,7 +50,7 @@ To create a Network Security Perimeter in the Azure portal, perform the followin 1. Enter **Name**, for example `storageblob-connectors-nsp` 1. Select a **Region**. The region must be the same region as the storage account. 1. Enter a **Profile name** or accept the default. The profile defines the set of rules that are applied to associated resources. You can have multiple profiles within a single NSP to apply different rules to different resources if required.-1. Select **Review + create** and then **Create**.+1. Select **Review + create**, then select **Create**.     :::image type="content" source="./media/enable-storage-network-security/create-network-security-perimeter.png" lightbox="./media/enable-storage-network-security/create-network-security-perimeter.png" alt-text="A screenshot showing the creation of a Network Security Perimeter in the Azure portal."::: @@ -80,19 +81,16 @@ To enable a system-assigned managed identity on the Event Grid system topic, per    :::image type="content" source="./media/enable-storage-network-security/select-event-system-topic.png" lightbox="./media/enable-storage-network-security/select-event-system-topic.png" alt-text="A screenshot showing the Event tab for Storage Accounts in the Azure portal.":::  1. Select **Identity**.- 1. On the **System assigned** tab, set the **Status** to **On**.-1. Select **Save**, then copy the **Object ID** of the managed identity. You need this Object ID when assigning the **Storage Queue Data Message Sender** role in the next section.+1. Select **Save**, then copy the managed identity's **Object ID**. You need this Object ID when assigning the **Storage Queue Data Message Sender** role in the next section.     :::image type="content" source="./media/enable-storage-network-security/create-system-assigned-identity.png" lightbox="./media/enable-storage-network-security/create-system-assigned-identity.png" alt-text="A screenshot showing the creation of a managed identity for an Event Grid System Topic in the Azure portal."::: - ### Grant RBAC permissions on the Storage Queue  To grant the Event Grid system topic managed identity permission to send messages to the storage queue, perform the following steps:  1. Navigate to your **Storage Account**.- 1. Select **Access Control (IAM)**. 1. Select **Add**. 1. Search for and select the **Storage Queue Data Message Sender** role (scope: the storage account).@@ -102,13 +100,11 @@ To grant the Event Grid system topic managed identity permission to send message 1. Select **Review + assign** to complete the role assignment.    :::image type="content" source="./media/enable-storage-network-security/add-role-assignment.png" lightbox="./media/enable-storage-network-security/add-role-assignment.png" alt-text="A screenshot showing the assignment of the Storage Queue Data Message Sender role to a managed identity in the Azure portal."::: - ### Enable Managed Identity on the event subscription  To enable managed identity on the event subscription, perform the following steps:  1. Open the **Event Grid System Topic**.- 1. Select the event subscription that targets the queue. 1. Select the **Additional settings** tab. 1. Set **Managed identity type** to **System-assigned**.@@ -117,7 +113,6 @@ To enable managed identity on the event subscription, perform the following step  :::image type="content" source="./media/enable-storage-network-security/set-additional-features.png" lightbox="./media/enable-storage-network-security/set-additional-features.png" alt-text="A screenshot showing the enabling of managed identity for an Event Grid subscription in the Azure portal."::: - ### Configure Inbound Access rules on the Network Security Perimeter profile  The following rules are required to allow Event Grid to deliver messages to the storage account while blocking unauthorized access. Depending on the system sending data to the storage account or accessing the storage resources, you may need to add additional inbound rules. Review your scenario and traffic patterns to determine whether you need only the required Event Grid rules or additional inbound NSP rules, and allow time for rule propagation.@@ -127,13 +122,12 @@ The following rules are required to allow Event Grid to deliver messages to the Event Grid delivery doesn't originate from fixed public IPs. The NSP validates delivery using subscription identity.  1. Navigate to Network Security Perimeter and select your NSP.- 1. Select **Profiles** and then select the profile associated with your storage account. 1. Select **Inbound access rules** and then select **Add**.     :::image type="content" source="./media/enable-storage-network-security/inbound-access-rules.png" lightbox="./media/enable-storage-network-security/inbound-access-rules.png" alt-text="A screenshot showing the Inbound access rules page in the Azure portal."::: -1. Enter a **Rule name**, for example `Allow-Subscription`.+1. Enter a **Rule name**; for example, `Allow-Subscription`.  1. Select *Subscription* from the **Source type** drop-down. 1. Select your subscription from the **Allowed Sources** drop-down.@@ -144,16 +138,15 @@ Event Grid delivery doesn't originate from fixed public IPs. The NSP validates d > [!NOTE] > Rules can take a few minutes to appear in the list after creation. - #### Rule 2: Allow Scuba service IP ranges +Create an inbound rule that allows the Scuba service IP ranges required for this scenario.  1. Create a second **Inbound access rules**.--1. Enter a **Rule name**, for example `Allow-Scuba`.+1. Enter a **Rule name**; for example, `Allow-Scuba`. 1. Select **IP address ranges** from the **Source type** drop-down. 1. Open the [Download Azure service tags JSON files](/azure/virtual-network/service-tags-overview#discover-service-tags-by-using-downloadable-json-files) page.-1. Select your cloud, for example **Azure Public**.+1. Select your cloud; for example, **Azure Public**. 1. Select the **Download** button and open the downloaded file to get the list of IP ranges. 1. Find the `Scuba` service tag and copy the associated IPv4 ranges. @@ -165,7 +158,6 @@ Event Grid delivery doesn't originate from fixed public IPs. The NSP validates d     :::image type="content" source="./media/enable-storage-network-security/scuba-ipv4-addresses.png" lightbox="./media/enable-storage-network-security/scuba-ipv4-addresses.png" alt-text="A screenshot showing a part of the ServiceTags_Public.json file with the Scuba service tag and IPv4 ranges highlighted."::: - ### Validate and enforce  After configuring the rules, monitor the diagnostic logs for the Network Security Perimeter to validate that legitimate traffic is allowed and there are no disruptions. Once you have confirmed that the rules are correctly allowing necessary traffic, you can switch from Transition mode to Enforced mode to block unauthorized access.@@ -177,8 +169,8 @@ Enable Network Security Perimeter diagnostic logs and review collected telemetry #### Apply Enforcement mode  Once validation is successful, set the access mode to **Enforced** as follows:-1. From the Network Security Perimeter page, under **Settings**, select **Associated resources**. +1. From the Network Security Perimeter page, under **Settings**, select **Associated resources**. 1. Select the storage account. 1. Select **Change access mode**. 1. Select **Enforced** and then **Save**.@@ -196,7 +188,6 @@ Use the diagnostic logs to investigate and resolve any issues that arise. Review Setting the storage account to **Secured by Perimeter** ensures that all traffic to the storage account is evaluated against the Network Security Perimeter rules and blocks public network access.  1. Navigate to your **Storage Account**.- 1. Under **Security + networking**, select **Networking**. 1. Under **Public network access**, select **Manage**. 1. Set **Secured by Perimeter (Most restricted)**.@@ -204,10 +195,8 @@ Setting the storage account to **Secured by Perimeter** ensures that all traffic  :::image type="content" source="./media/enable-storage-network-security/set-storage-networking.png" lightbox="./media/enable-storage-network-security/set-storage-networking.png" alt-text="A screenshot showing how to set a storage account to 'Secured by Perimeter' in the Azure portal."::: +## Related content -## Next steps--In this article, you learned how to enable network security on the storage resources integrated with your Azure Storage connector. For more information, see the [Network Security Perimeter](/azure/private-link/network-security-perimeter-concepts) articles.--- Review data-connection rules in [Azure Storage data connection rules reference](data-connection-rules-reference-azure-storage.md).-- Troubleshoot connector networking issues in [Troubleshoot the Azure Storage Blob connector](azure-storage-blob-connector-troubleshoot.md).\ No newline at end of file+- [What is a network security perimeter?](/azure/private-link/network-security-perimeter-concepts)+- [Azure Storage Blob data connector reference for the Codeless Connector Framework](data-connection-rules-reference-azure-storage.md)+- [Troubleshoot Azure Storage Blob connector issues](azure-storage-blob-connector-troubleshoot.md)