Question

Your company runs analytics VMs in a subnet named 'data-subnet' that already has a Microsoft.Storage service endpoint enabled. Security has discovered that VMs can currently reach any Azure Storage account over the service endpoint, including personal storage accounts used for data exfiltration. You must ensure the VMs in 'data-subnet' can only access the two approved storage accounts in your subscription, while still using the service endpoint path. What should you implement?

Accepted Answer

Create a service endpoint policy that lists the two approved storage account resource IDs and associate it with 'data-subnet'.

Answer

Configure the storage account firewall on the two approved accounts to allow only 'data-subnet', then remove the service endpoint.

Answer

Replace the service endpoint with private endpoints for the two approved storage accounts and disable public network access.

Answer

Add an NSG on 'data-subnet' with outbound rules using the Storage service tag scoped to the two account IP ranges.