Question

Your company runs a set of application VMs in a subnet named AppSubnet within a virtual network. These VMs need to access an Azure Storage account, but the security team requires that the storage account reject all traffic except from AppSubnet, while keeping traffic on the Azure backbone and avoiding public internet exposure for that traffic. You do not want to deploy any additional resources into the VNet. Which approach meets these requirements with the least administrative effort?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet, then configure the storage account firewall to allow only that subnet.

Answer

Create a private endpoint for the storage account in AppSubnet and configure a private DNS zone.

Answer

Add a network security group rule on AppSubnet to allow outbound traffic only to the Storage service tag.

Answer

Configure a user-defined route on AppSubnet directing storage traffic through an Azure Firewall.