You configure a storage account named 'prodstore01' with the public network access setting restricted to a single virtual network subnet. After applying the firewall rules, an Azure Backup job that previously wrote recovery data to this storage account begins to fail because it cannot reach the storage account. You must allow the Azure Backup service to access the storage account without exposing it to the public internet or adding broad IP ranges. What should you do?