After Microsoft.Storage is enabled on a grain-elevator subnet, every regional storage account becomes reachable from that subnet. How should the engineer allow only the elevator’s account?
Select an answer to reveal the explanation.
Short Explanation
Service Endpoint without a guest list is an open house for every storage account in the region. Hang a Service Endpoint policy that names only the elevator’s account.
Full Explanation
Service endpoint policies for Azure Storage limit which storage accounts a subnet with a Microsoft.Storage Service Endpoint may reach. Without a policy, the subnet can reach storage accounts more broadly in the service’s regional scope. A Private Link service publishes your own load-balanced service; it is not the Storage Service Endpoint companion. Azure Policy and opening the firewall to all networks are not the first least-privilege control for this Service Endpoint scenario.