A Private Endpoint for Blob is up, but lock-app VMs still resolve *.blob.core.windows.net to a public IP and fail after public access is disabled. What DNS fix is required?
Select an answer to reveal the explanation.
Short Explanation
Private Endpoint without privatelink DNS is a locked door with the wrong address on the map. Link the privatelink zone so the Blob FQDN lands on the private IP.
Full Explanation
Clients must resolve the storage FQDN to the Private Endpoint private IP. Linking the appropriate privatelink Private DNS zone to the VNet (or equivalent DNS mapping) provides that resolution. Without it, public DNS continues to return a public IP, which fails when public network access is disabled. App Service VNet integration is an outbound app networking feature, not storage PE DNS. NSG service tags and renaming the account do not fix Private Endpoint name resolution.