Storage firewall, trusted services exceptions, and Defender for Storage (activity monitoring, malware scanning, sensitive data threat detection)

By default a storage account's endpoints accept connections from any network, relying only on authorization to keep data safe. The storage firewall (the Networking blade) adds a network layer. Public network access can be Enabled from all networks, Enabled from selected virtual networks and IP addresses, or Disabled. With selected networks, you add virtual network subnets (which need the Microsoft.Storage service endpoint) and public IP ranges in CIDR form; private IP ranges cannot be used in IP rules. With Disabled, only private endpoints can reach the account. Network rules are enforced on all protocols, including REST and SMB, and a request must pass both the firewall and authorization.