Contoso has an Azure Storage account accessed by VMs in a subnet secured with a service endpoint (Microsoft.Storage). The storage firewall allows only that subnet. On-premises administrators connect over an ExpressRoute private peering circuit and must also reach the same storage account using the firewall rules. When they attempt access from on-premises, the connection is denied even though the ExpressRoute circuit is healthy. What is the reason and the correct remediation?