Answered

How to Configure Security on Azure Storage Account to allow only Power Pages to access

(1) Share

Report

Posted on by indlad

Hello Power Pages Community,

We followed Enable Azure storage | Microsoft Learn and configured Azure Blob Storage to attach files. Everything is working fine but the defender raised a security concern with - "Storage accounts should prevent shared key access".

I know the default Public network access is Enabled for all Inbound and outbound access and Enabled for All networks.

Do you have any documentation on how we can configure Enable from selected networks and allow only for the purpose of sharing this Storage account for Power Pages?

what have I done.

I checked the Storage account logs on StorageBlobLogs table and checked CalledIPAddress and captured all of these and they are all 10.xx.xx.xx , So

I configured Virtual network and created address space with 10.xx.xx.xx and then subnet and added them under virtual network on the storage account. Still its failing to attach documents.

I also added PowerPlatformInfra IP Addresses from -Download Azure IP Ranges and Service Tags – Public Cloud from Official Microsoft Download Centre

and just tried with "Allow Microsoft Trusted Services to access this resource" but once we restrict to "Enable for specific network" attachment upload is failing.

Any help on this will be appreciated.

Thank you in advance.

Regards,

Daniel.

Categories:

Security

I have the same question (0)

All responses (2)

Answers (0)

Sort by

Suggested answer

11manish 2,487 on at

Like (1)

Report
Copy link

Link copied!
The issue is expected behavior with the current Power Pages and Azure Blob Storage integration.

Although StorageBlobLogs shows 10.x.x.x IP addresses, these are Microsoft-managed internal addresses and cannot be replicated by creating your own Virtual

Network or subnet.

Currently, Power Pages attachment integration does not fully support:

Restricting the Storage Account to “Selected networks”

Disabling Shared Key access

Because Power Pages relies on SAS token and Shared Key-based access, enabling “Selected networks” or disabling Shared Key access commonly causes attachment

upload/download failures.

Recommended approach:

Keep Public Network Access enabled

Keep Shared Key access enabled

Use additional security controls such as private containers, HTTPS-only access, SAS expiration policies, Defender monitoring, and RBAC

Document the Defender recommendation as an accepted exception if Power Pages attachment functionality is required

If strict network isolation is mandatory, a custom integration approach (Azure Function/API proxy, Dataverse storage, etc.) would be required.

Was this reply helpful? Yes No
indlad 10 on at

Like (1)

Report
Copy link

Link copied!

Hello @11manish,

Thank you so much for your reply. This is very helpful. Do you know any documentation on this from Microsoft. That will be helpful to share with our security team to give an exemption for this vulnerability that the Microsoft defender showing

Was this reply helpful? Yes No