A lock-app subnet in East US still cannot use the Service Endpoint path to Storage until the service is opted in. What must the security engineer configure?
Select an answer to reveal the explanation.
Short Explanation
Service Endpoint is a subnet checkbox plus the storage firewall’s VNet hello. Enable Microsoft.Storage on that East US subnet—don’t invent Private DNS or blast Internet Allows.
Full Explanation
A Service Endpoint is enabled as a subnet setting for a specific service such as Microsoft.Storage and is paired with allowing that virtual network on the storage account’s selected-networks firewall. Private DNS privatelink zones are part of Private Endpoint design, not Service Endpoint enablement. Opening Internet in the NSG while leaving the service disabled does not create the Service Endpoint path. Cross-region moves are not a substitute for subnet opt-in.