An App Service still egresses to public Storage even though VNet integration is on, so traffic misses the hub Azure Firewall. What should the security engineer enable?
Select an answer to reveal the explanation.
Short Explanation
VNet integration without Route All still lets public Storage sneak out the side door. Flip Route All so outbound obeys the subnet UDR toward the hub firewall.
Full Explanation
With regional VNet integration, enabling Route All (vnetRouteAllEnabled) forces application outbound traffic to follow the integration subnet’s routes, including UDRs to Azure Firewall, rather than sending only RFC1918 prefixes into the VNet. Without route-all, calls to public Storage can bypass the hub firewall. Ad-hoc WEBSITE_* folklore and Functions host.json edits are not the documented control. Removing VNet integration works against the forced-tunnel goal.