# Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access

- Source: https://support.icompaas.com/support/solutions/articles/62000219788-ensure-allow-azure-services-on-the-trusted-services-list-to-access-this-storage-account-is-enabled-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [3. Storage Accounts](https://support.icompaas.com/support/solutions/folders/62000167546)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

The “Allow Azure services on the trusted services list to access this storage account” setting in Azure Storage Accounts allows Microsoft-designated trusted Azure platform services to bypass network restrictions, such as firewalls or virtual network rules, in order to access the storage account. This exception applies only to services explicitly identified by Microsoft as trusted and does not permit public access or user-initiated connections.

  

Rationale:

Enabling this setting ensures that critical Azure platform services continue to function even when the storage account is restricted to selected networks. Without this configuration, essential services such as backups, monitoring, and replication may fail, potentially impacting business continuity and compliance with operational standards.

  

Impact:

-   Ensures critical Azure services (backup, monitoring, disaster recovery, logging) can operate without interruption.
    
-   Maintains business continuity while enforcing network security restrictions.
    
-   Reduces the risk of service failures due to blocked storage access.
    
-   Only Microsoft trusted services are allowed; user access or unknown services remain blocked.
    
-   Does not expose the storage account to the public internet.
    

  

Default Value:

-   When network restrictions are configured on an Azure Storage Account, trusted Microsoft services are not allowed by default.
    
-   The “Allow trusted Microsoft services to access this storage account” setting must be explicitly enabled.
    

  

Pre-requisites:

-   An existing Azure Storage Account
    
-   Required permissions: Owner, Contributor, or Storage Account Contributor
    

  

Test Plan:

1.  Sign in to the Azure Portal [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Storage Accounts
    
3.  Select the target storage account
    
4.  In the left navigation pane, under Security + networking, select Networking
    
5.  Under Public network access, verify that the setting is configured as:  
    Enabled from selected networks.
    
6.  Locate the Exceptions section
    
7.  Verify that “Allow trusted Microsoft services to access resource” is enabled
    
8.  If not, follow the implementation steps
    

![](https://support.icompaas.com/assets/kb/88cd6a121a7e8072.png)

Implementation Steps:

1.  Sign in to the Microsoft Azure Portal [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Storage Accounts and select the target storage account.
    
3.  In the left-hand menu, under Security + networking, select Networking.
    

  

![](https://support.icompaas.com/assets/kb/daa28f8a343724b6.png)

  

  

4.  Click Public network access and set the scope to Enable from Selected networks.
    

  

![](https://support.icompaas.com/assets/kb/48011875a60fddc5.png)

  

5.  Ensure that Enabled from selected virtual networks and IP addresses is selected.
    
6.  Locate the Exceptions section, select Allow trusted Microsoft services to access this resource.
    
7.  Click Save to apply the changes
    

![](https://support.icompaas.com/assets/kb/4f2da3b8ee59bbca.png)

  

Backout Plan:

1.  Sign in to the Microsoft Azure Portal [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Storage Accounts
    
3.  Select the target storage account
    
4.  In the left navigation pane, under Security + networking, select Networking
    
5.  Under Public network access, ensure the setting remains configured as:  
    Enabled from selected networks
    
6.  Locate the Exceptions section
    
7.  Disable Allow trusted Microsoft services to access this storage account
    
8.  Click Save to apply the changes
    

  

Reference:

-   [https://learn.microsoft.com/en-us/azure/search/search-indexer-howto-access-trusted-service-exception](https://learn.microsoft.com/en-us/azure/search/search-indexer-howto-access-trusted-service-exception)
    

[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy")**[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy")**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.