Azure File Share Private Endpoint

Question

Azure File Share Private Endpoint

Handian Sudianto 7,511

Can we access azure file share using private endpoint ip address or custom dns rather than use record on azure private dns?

0 comments

2 answers

Your answer

Answer 1

Marcin Policht 109.9K MVP Volunteer Moderator

In short - yep - but there are a few caveats.

You can use your own custom DNS infrastructure, however, you need to configure your custom DNS so that the storage account's original FQDN resolves to the private endpoint's IP address.

On your custom DNS server, you can create a forward lookup zone for privatelink.file.core.windows.net and add an A record mapping the storage account name to the private endpoint IP address. Alternatively, you can use conditional forwarders to direct queries for the relevant Azure private-link namespace to an Azure Private DNS Resolver.

When mounting the share, always use the original FQDN, such as mystorageaccount.file.core.windows.net, rather than the privatelink name. DNS should transparently resolve that original name to the private endpoint IP address. This allows applications and clients to continue using the normal Azure Files endpoint name while the actual network traffic is routed through the private endpoint.

Although you might be able to establish a basic network connection to the private endpoint IP address, mounting Azure Files directly by IP address is not a documented or supported access pattern and can cause important functionality to fail.

For identity-based authentication using AD DS or Azure AD Kerberos, the authentication process depends on name resolution and the server's FQDN. Targeting the service by IP address can effectively prevent Kerberos authentication from working correctly.

IP-based access can also cause SSL/TLS certificate validation problems when using HTTPS-based interfaces such as the FileREST API. The certificate presented by Azure is issued for the Azure Files hostname, such as *.file.core.windows.net, rather than for the private endpoint's IP address. Connecting by IP can therefore result in a certificate name mismatch.

SMB access should likewise use the server's hostname rather than the private endpoint IP address. The supported approach is to preserve the normal Azure Files FQDN and make DNS resolve that name to the private endpoint address.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Handian Sudianto 7,511 Reputation points

2026-10-06T12:07:49.02+00:00

hi @Marcin Policht

Currently i have some storage account spread on different region, different subscription but on same tenant.

If i make private dns for storage account on region1 and subscription1 this mean all other storage account in other location should use private endpoint also? So inside the private dns there are 2 A host record?
Marcin Policht 109.9K Reputation points MVP Volunteer Moderator

2026-10-06T13:21:56.78+00:00
Nope - creating a Private DNS zone does not force your other storage accounts to use private endpoints. When you create a Private DNS zone named privatelink.file.core.windows.net (or privatelink.blob.core.windows.net) and link it to your Virtual Network (VNet), Azure DNS changes how it resolves names. If a virtual machine inside that VNet queries a storage account that has a private endpoint record in that zone, the name resolves to the private IP address associated with the private endpoint.

If it queries a storage account that does not have a record in that zone, the name continues to resolve through public DNS to the storage account's public endpoint. Therefore, your other public storage accounts can continue to operate normally over the public internet.

There should be two A host records inside the Private DNS Zone - but only if you decide to create private endpoints for both storage accounts.

Azure Private DNS zones are global resources, so a single zone can contain records for resources located in different Azure regions and subscriptions. If you choose to protect both storage accounts with private endpoints, you would have two distinct A records in the same Private DNS zone.

For example, Storage Account A could be located in Region 1, Subscription 1, with the private endpoint IP address 10.1.0.5. Storage Account B could be located in Region 2, Subscription 2, with the private endpoint IP address 10.2.0.5.

Inside a single Private DNS zone such as privatelink.file.core.windows.net, the records would therefore look like this:

| Host (Name) | Type | Value (IP Address) | | ----------- | ---- | ------------------ | | `storagea` | A | `10.1.0.5` | | `storageb` | A | `10.2.0.5` |

Instead of creating multiple Private DNS zones with the exact same name across different subscriptions, which can complicate DNS management and name resolution, consider using a centralized DNS hub architecture.

Deploy a single central Private DNS zone, for example in a hub VNet or core subscription. Link that Private DNS zone to the VNets across your different regions and subscriptions. When private endpoints are created in any region or subscription, their corresponding A records can then be registered in the central Private DNS zone.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Handian Sudianto 7,511 Reputation points

2026-10-06T13:53:04.33+00:00
hi @Marcin Policht

In my case i have private endpoint below :

Private Endpoint IP 10.100.1.1 have name share01.file.core.windows.net located in region1, subscription1

Private Endpoint IP 10.200.1.1 have name share02.file.core.windows.net localted in region2, subscription2

Then i have private DNS zone named privatelink.file.core.windows.net and inside this zone contain share01.file.core.windows.net.

If i create DNS conditional forwarder in my internal DNS to forward domain privatelink.file.core.windows.net then i need A record for share02 also in the private zone, am i right?

To which ip i should forward the privatelink.file.core.windows.net for my conditional forwarder?
Marcin Policht 109.9K Reputation points MVP Volunteer Moderator

2026-10-06T17:39:49.9666667+00:00

The central Private DNS zone should contain records for both storage accounts: share01 → 10.100.1.1 and share02 → 10.200.1.1. The fact that share02 is in another subscription and region does not prevent this; Azure Private DNS zones are global. The VNets in both regions simply need connectivity to the VNet linked to the Private DNS zone.

The internal DNS conditional forwarder should be configured for file.core.windows.net, not privatelink.file.core.windows.net. Clients initially query share02.file.core.windows.net, so forwarding only the privatelink namespace would not intercept the original query.

The forwarder cannot point directly to Azure's 168.63.129.16 from on-premises. The recommended approach is Azure DNS Private Resolver - deploy an inbound endpoint in Azure and point the on-premises conditional forwarder to its private IP. Alternatively, a DNS-forwarding VM (e.g. a small Linux VM) can be deployed in Azure and configured to forward queries to 168.63.129.16.

The resulting flow is: client → internal DNS → conditional forwarder for file.core.windows.net → Azure DNS Private Resolver → Azure Private DNS zone → share02 resolves to 10.200.1.1.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Handian Sudianto 7,511 Reputation points

2026-10-06T23:32:18.6833333+00:00

hi @Marcin Policht

Thanks, but can we use custom name? Example we want access the share using name share01.internaldomain.net ?

Answer 2

Yes.

A private endpoint gives the file share a private IP in a virtual network, and clients can access it from that virtual network, peered virtual networks, or connected on-premises networks.

For name resolution, Azure Files does not require Azure Private DNS specifically. A private DNS zone is created or reused by the standard setup, but custom DNS is supported as long as clients resolve the file share’s original host name to the private endpoint’s private IP address.

Key points:

Custom DNS is supported
- Custom DNS infrastructure can be used instead of Azure Private DNS.
- The requirement is that the file share host name resolves to the private endpoint IP.
Use the original host name when mounting
- Do not mount by using the privatelink name.
- Use the file share’s original hostName.
Directly using the private endpoint IP is not the documented access pattern
- The documented model is DNS-based access using the same host name, which resolves either to the public endpoint or the private endpoint depending on DNS.
- The guidance provided is to mount using the original host name, not the private IP.
DNS behavior matters
- In networks using private DNS for the share, the host name resolves to the private endpoint IP.
- With public DNS, it resolves to the public endpoint instead.

So the supported approach is:

keep using the file share’s original host name,
use Azure Private DNS or custom DNS,
make sure that name resolves to the private endpoint’s private IP.