Create an IP network rule for Azure Storage

You can deny all public access to your storage account and then configure Azure network settings to accept requests from specific IP address ranges. To enable traffic from specific public IP address ranges, create one or more IP network rules. To learn more, see Permit access to IP address ranges.

Create an IP network rule

Go to the storage account for which you want to manage IP network rules.
In the service menu, under Security + networking, select Networking.
To allow traffic from IP address ranges, make sure that Enabled from selected virtual networks and IP addresses is selected.
To grant access to an internet IP range, enter the IP address or address range (in CIDR format) under Firewall > Address Range.
To remove an IP network rule, select the delete icon ( ) next to the address range.
Select Save to apply your changes.

Install Azure PowerShell and sign in.
To allow traffic from IP address ranges, use the Update-AzStorageAccountNetworkRuleSet command and set the -DefaultAction parameter to Deny:
```
Update-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -DefaultAction Deny
```
Important

Network rules have no effect unless you set the -DefaultAction parameter to Deny. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting.

List IP network rules:

(Get-AzStorageAccountNetworkRuleSet -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount").IPRules

Add a network rule for an individual IP address:

Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19"

Add a network rule for an IP address range:

Add-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24"

Remove a network rule for an individual IP address:

Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.19"

Remove a network rule for an IP address range:

Remove-AzStorageAccountNetworkRule -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -IPAddressOrRange "16.17.18.0/24"

Install the Azure CLI and sign in.
To allow traffic from IP address ranges, use the az storage account update command and set the --default-action parameter to Deny:
```
az storage account update --resource-group "myresourcegroup" --name "mystorageaccount" --default-action Deny
```
Important

Network rules have no effect unless you set the --default-action parameter to Deny. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting.