5.2.2. Service Endpoint Policies
Service Endpoint Policies restrict which specific resources a subnet can access—even within an allowed service.
Use Case:
- Allow access to only YOUR storage accounts, not all storage accounts
- Prevent data exfiltration to unauthorized accounts
Configuration:
{
"service": "Microsoft.Storage",
"serviceResources": [
"/subscriptions/{sub-id}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{account-name}"
]
}
The threat this closes is subtle. A service endpoint tells the subnet "you may reach Azure Storage over the backbone" — all of Azure Storage, including a storage account in somebody else's subscription. An insider or a compromised process can therefore copy data to an account you do not own, over a path your firewall rules consider trusted. A service endpoint policy narrows that permission from "the service" to "these specific resources".
The policy attaches to the subnet, alongside the endpoint itself, which is why it is enforced no matter what the destination account's own firewall allows.
⚠️ Exam Trap: Service endpoint policies currently support Azure Storage only. If a scenario asks you to restrict which specific SQL databases or key vaults a subnet may reach, the answer is a private endpoint, not a policy.
💡 First Principle: The endpoint grants access to a service; the policy narrows it to resources. Any question containing the word "exfiltration" is asking about the second one.
