Can I restrict batch account linked auto storage with Firewall and azure virtual network setting?

Question

I have batch account with auto storage linked where the application packages are stored. I want to restrict the access on the this batch linked auto storage with virtual network settings.
I tried adding vnet setting and allowed the subnet of my selfhost virtual machine scale set agents , from devops pipeline I am tryingto execute powershell script which uploads the application package to the batch account using below command

New-AzBatchApplicationPackage -AccountName $BatchAccountName -ResourceGroupName $ResourceGroupName -ApplicationId $ApplicationName -ApplicationVersion $newVersionNumber -Format zip -FilePath $PackageFilePath

this command works when the storage network setting all networks is enabled, but when I try to select the selected network , the command files to upload the package with the error Failed to add application package DataExportProcessor version 89.0. The auto storage account keys are invalid, please sync auto storage keys.

In the storage selected network I am allowing my devops scale set agent subnet but , I am not uploading package directly to the storage from scale set machine, the New-AzBatchApplicationPackage command uploads the application package to storage, but I am not sure which IP , I should whitelist in my storage account so that batch account can update the application package

Answer 1

Please note that, while setting firewall of storage account you need to select All Networks .

If you want to choose selected network, then you have to add your public IP address and the list of the IPs of the BatchNodeManagement to your Storage Account firewall.

To get the list of those IPs, you can refer this blog by Amine Charot.

Make sure to add IPs like below:

To resolve the "Failed to add application package DataExportProcessor version 89.0. The auto storage account keys are invalid, please sync auto storage keys" please check whether the keys in storage account and batch account are same or not.

If not sync like below:

Go to Azure Portal -> Your Batch Account -> Storage Account -> SyncKeys

Reference:

Package deployment failures (microsoft.com)