Your company runs several VMs in a virtual network in the East US region. These VMs need to securely access an Azure Storage account, and you must keep the traffic on the Microsoft backbone without exposing the storage account to the public internet. The solution must avoid the per-hour and data-processing charges associated with dedicated network interfaces, and the storage account will remain in the same region as the VNet. You do not require access from on-premises networks. Which approach best meets these requirements at the lowest cost?