Overview
If you have the following situation:
- M-Files Cloud vault.
- Azure File Share storage that you use with this vault (e.g., for Replication or Classic File Source purposes).
- Both the vault and your Azure File Share are in the same Azure region.
- You use IP-based rules in your Azure Firewall for the file share to restrict access only to the public IP addresses of your vault.
You may experience a connectivity break where the replication or file source may stop working and you may see errors like "Access Denied".
Example error:
"Reading from the external location '\\mytenant.flies.core.windows.net\some\path\' failed. Access is denied."
Details
This issue stems from a limitation in the Azure Firewall with IP-based rules:
- You can't use IP network rules to restrict access to Azure services deployed in the same region as the storage account.
- Services deployed in the same region as the storage account use private Azure IP addresses for communication. Therefore, you can't restrict access to specific Azure services based on their public outbound IP address range.
Note that M-Files does not own the source article, so we cannot guarantee its availability and content, the quotes above are taken at the time of writing (October 2025).
Solution
You can consider the following options:
- Remove the IP restrictions from the Firewall.
- Move the Azure Storage you use to another region.
- In case of a Classic File Source, consider importing its data and adding any further updates via other tools, so you don't have to use this setup.
Note that this applies to the situation where the issue is caused by the Firewall rules. You can test if this is the case by disabling them temporarily. There can be configuration sources of such an error, such as wrong or expired credentials, or wrong paths that you can fix by ensuring the configuration is correct.
