#Allow AvePoint Agent Servers to Access Your Storage Account

If you are going to protect Azure storage or use your own storage device to store the backup data, read the instructions in this section carefully and complete the settings as needed. Otherwise, you can skip this topic.

When you are using your own storage, you may have set up the storage firewall to only allow trusted clients to access for security concerns. To ensure that AvePoint cloud products can access your storage, complete the settings as required in the following conditions:

• If you use a storage type other than Microsoft Azure storage, you must add reserved IP addresses to your storage firewall. To get the list of the reserved IP addresses, refer to Download a List of Reserved IP Addresses.

• If you are using Microsoft Azure storage, refer to the following:

• If your storage account is in the same data center as the one you use to sign up for AvePoint Online Services or your storage account is in its paired region, you must add the Azure Resource Manager (ARM) VNet subnets where the AvePoint agents are running on to your storage networking. You can find additional details in this Microsoft article: Grant access from a virtual network, and get the subnet ID of AvePoint cloud products for your data center from Download ARM VNet IDs. For detailed instructions, refer to Add ARM virtual networks.

• Other than the condition above, you need to add all the reserved IP addresses to the Azure storage firewall. For details, refer to Add reserved IP addresses.

#Add reserved IP addresses

Follow the steps below:

1. Navigate to AvePoint Online Services interface > Administration > Security.

2. Click Download next to the Reserved IP Addresses tile to download the list of reserved IP addresses of AvePoint Online Services. For details, refer to Download a List of Reserved IP Addresses.

3. Go to the storage account that you want to secure.

4. Select Networking on the menu.

5. Check that you have selected to allow access from Selected networks.

6. Enter the IP address or address range under Firewall > Address Range.

7. Select Save to apply your changes.

#Add ARM virtual networks

There are two ways to grant access to a subnet in a virtual network belonging to another tenant:

• Use the Azure CLI tool (https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest)

  ## Use the Azure CLI tool # Step 1 (Optional): If you have multiple Azure subscriptions, please switch to the correct subscription # This command sets the active subscription to the specified subscription ID. az account set --subscription xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy # Step 2 (Optional): Confirm whether the subscription switch is correct # This command displays the current subscription information in a table format. az account show --output table # Step 3: Get the AvePoint Online Services network subnet resource ID # This variable stores the resource ID of the subnet in the virtual network. # Replace with the Azure Resource Manager (ARM) VNet ID downloaded from your AvePoint Online Services tenant. $SUBNETID="/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy/resourceGroups/ResourceGroupName/providers/Microsoft.Network/virtualNetworks/VirtualNetworkName/subnets/SubnetName" # Step 4: Set your resource group name # This variable stores the name of the resource group where your storage account is located. $DESTRG="customer_resource_group_name" # Step 5: Set your storage account name # This variable stores the name of the storage account to which you want to add the network rule. $DESTSTA="customer_storage_account_name" # Step 6: Add the firewall virtual network rule to grant access to AvePoint Online Services # This command adds a network rule to the specified storage account, allowing access from the specified subnet. az storage account network-rule add --resource-group $DESTRG --account-name $DESTSTA --subnet $SUBNETID # Step 7: List the current network rules for the storage account to verify the addition # This command lists the virtual network rules for the specified storage account. az storage account network-rule list --resource-group $DESTRG --account-name $DESTSTA --query virtualNetworkRules # Step 8 (Optional): Disable the public access to storage account # This command updates the storage account to deny public network access. az storage account update --resource-group $DESTRG --name $DESTSTA --default-action Deny # Step 9 (Optional): Verify that the default action for network rules is set to Deny # This command shows the network rule set for the specified storage account, including the default action. az storage account show --resource-group $DESTRG --name $DESTSTA --query networkRuleSet.defaultAction

• Use the Azure Az PowerShell (https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell?view=azps-14.2.0)

  ## Use the Azure Az PowerShell # Step 1: Sign in to Azure with your Azure Admin account Connect-AzAccount # Step 2 (Optional): If you have multiple Azure subscriptions, please switch to the correct subscription # This command sets the active subscription to the specified subscription ID. Set-AzContext -SubscriptionId "xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy" # Step 3: Get the AvePoint Online Services network subnet resource ID # This variable stores the resource ID of the subnet in the virtual network. # Replace with the Azure Resource Manager (ARM) VNet ID downloaded from your AvePoint Online Services tenant. $SUBNETID="/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy/resourceGroups/ResourceGroupName/providers/Microsoft.Network/virtualNetworks/VirtualNetworkName/subnets/SubnetName" # Step 4: Set resource group name # This variable stores the name of the resource group where your storage account is located. $DESTRG="customer_resource_group_name" # Step 5: Set storage account name # This variable stores the name of the storage account to which you want to add the network rule. $DESTSTA="customer_storage_account_name" # Step 6: Add the firewall virtual network rule to grant access to AvePoint Online Services # This cmdlet adds a network rule to the specified storage account, allowing access from the specified subnet. Add-AzStorageAccountNetworkRule -ResourceGroupName $DESTRG -Name $DESTSTA -VirtualNetworkResourceId $SUBNETID # Step 7: Verify the newly added network rule # This cmdlet retrieves the network rule set for the specified storage account. Get-AzStorageAccountNetworkRuleSet -ResourceGroupName $DESTRG -AccountName $DESTSTA

You will see the virtual network rules in Azure Portal, as the screenshot below shows. You may also notice that a warning message “Insufficient Permission…” is displayed. It is because the subnet is not in your subscription. You can ignore it.