A private endpoint is the appropriate mechanism because it exposes the Azure Storage service through a private IP address associated with Subnet1 . Private endpoints support Azure virtual network network policies, including network security groups (NSGs) . When private-endpoint network policies are enabled for the subnet, NSG rules can be applied to traffic destined for the private endpoint, allowing network access to be controlled through the NSG associated with Subnet1.

This differs materially from a service endpoint . Service endpoints continue to access Azure Storage through its public service endpoint and require service-side virtual network ACL/firewall configuration to restrict which subnets may access the storage account. Microsoft explicitly states that enabling a service endpoint alone is insufficient: the Azure service must also be configured with appropriate virtual-network access controls. Therefore, access would not be governed only by the NSG.

An Azure Private Link service is used to privately publish a customer-owned service, typically behind a load balancer; it is not required to consume Azure Storage privately. A UDR controls routing and does not establish private access to Storage.

For a complete private-access design, the storage account ' s public endpoint should also be restricted or disabled. Microsoft recommends private endpoints when private network access to Azure Storage is required.