Storage firewalls and virtual network rules, trusted Microsoft services, private endpoints for storage

By default a new storage account accepts connections from any network and relies on authorization (keys, shared access signatures or Microsoft Entra ID) to keep data safe. The storage firewall adds a network layer: even a request with a valid key is refused if it does not come from an allowed network. You configure it under the account's Networking blade, where public network access can be enabled from all networks, enabled from selected virtual networks and IP addresses, or disabled. Defense in depth means using both layers: strong authorization and restricted networks.