A financial services company had recently migrated several key applications to Azure. These cloud-based applications managed critical customer data and financial transactions, so ensuring they are secure and performing optimally is essential.

Skills: Business Continuity Solutions, Data Storage Solutions, Identity, Governance and Monitoring Solutions

With Shared Access Signatures (SAS) tokens in Azure, you can grant limited access to your storage resources without sharing your account keys.

To allow on-premises services access to Azure storage account, without exposing the storage account to the internet, you can:

• Set up a VPN from on-premises to Azure
• Configure a storage account private endpoint.

VPN -> Azure Cloud + access public Azure services (without traversing the internet) = Private endpoint.

Resolve a FQDN to an IPv6 address with AAAA DNS record. 

To ensure that only certain VMs in your Azure environment can resolve FQDNs to IPs in Azure-hosted DNS zone:

• Deploy the VMs in a single virtual network and allow the virtual network access to the private DNS zone
• Create a private DNS zone