A water-lab subnet must reach Azure Storage on the Microsoft backbone and must not be opened to the whole Internet. How should the NSG destination be expressed?
Select an answer to reveal the explanation.
Short Explanation
Don’t babysit Storage’s public IP phone book. Point the NSG at the Storage service tag and let Microsoft keep the list honest while you stay off wide-open Internet.
Full Explanation
Service tags represent groups of Microsoft-managed IP prefixes for Azure services and can be used as NSG source or destination. Using Storage or a regional Storage.* tag lets the subnet reach Azure Storage without opening destination Any and without maintaining fragile handwritten public IP lists. Azure RBAC on the storage account authorizes identity, not the network path defined by the NSG.