Remediate from Azure Portal - Open the Storage Accounts blade - For each listed Storage Account, perform the following: - Under the Security + networking heading, click on Networking - Click on the Private endpoint connections tab at the top of the networking window - Click the + Private endpoint button - In the 1 - Basics tab/step: - Enter a name that will be easily recognizable as associated with the Storage Account ( Note : The "Network Interface Name" will be automatically completed, but you can customize it if needed.) - Ensure that the Region matches the region of the Storage Account - Click Next - In the 2 - Resource tab/step: - Select the target sub-resource based on what type of storage resource is being made available - Click Next - In the 3 - Virtual Network tab/step: - Select the Virtual network that your Storage Account will be connecting to - Select the Subnet that your Storage Account will be connecting to - (Optional) Select other network settings as appropriate for your environment - Click Next - In the 4 - DNS tab/step: - (Optional) Select other DNS settings as appropriate for your environment - Click Next - In the 5 - Tags tab/step: - (Optional) Set any tags that are relevant to your organization - Click Next - In the 6 - Review + create tab/step: - A validation attempt will be made and after a few moments it should indicate Validation Passed - if it does not pass, double-check your settings before beginning more in depth troubleshooting. - If validation has passed, click Create then wait for a few minutes for the scripted deployment to complete. Repeat the above procedure for each Private Endpoint required within every Storage Account. Remediate from PowerShell $storageAccount = Get-AzStorageAccount -ResourceGroupName '' -Name '' $privateEndpointConnection = @{ Name = 'connectionName' PrivateLinkServiceId = $storageAccount.Id GroupID = "blob|blob_secondary|file|file_secondary|table|table_secondary|queue|queue_secondary|web|web_secondary|dfs|dfs_secondary" } $privateLinkServiceConnection = New-AzPrivateLinkServiceConnection @privateEndpointConnection $virtualNetDetails = Get-AzVirtualNetwork -ResourceGroupName '' -Name '' $privateEndpoint = @{ ResourceGroupName = '' Name = '' Location = '' Subnet = $virtualNetDetails.Subnets[0] PrivateLinkServiceConnection = $privateLinkServiceConnection } New-AzPrivateEndpoint @privateEndpoint Remediate from Azure CLI az network private-endpoint create --resource-group --location --name --vnet-name --subnet --private-connection-resource-id --connection-name --group-id Impact: If an Azure Virtual Network is not implemented correctly, this may result in the loss of critical network traffic. Private endpoints are charged per hour of use. Refer to https://azure.microsoft.com/en-us/pricing/details/private-link/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs.

Detections

Analytics

Item Search