An organization needs to configure Azure AI Services to use a virtual network service endpoint and restrict access to resources only within a specific subnet. After enabling the service endpoint, requests from on-premises networks connected via ExpressRoute should still be permitted. Which configuration supports this topology?

A is correct because Azure AI Services (Cognitive Services) network rules support two complementary controls: (1) Virtual network rules that restrict access to specific subnets with the service endpoint enabled, and (2) IP network rules that allow specific public IP ranges. On-premises networks connected via ExpressRoute use private ASN-based routing but appear to Azure AI Services as originating from public IP addresses assigned to the on-premises network. Adding the on-premises public IP range to the IP firewall rules permits their traffic alongside the VNet subnet rules. B is wrong because switching to private endpoints is a valid but different architectural approach that changes how all traffic reaches the service; the question asks about configuring within the service endpoint topology. C is wrong because 'Allow trusted Microsoft services' bypasses the firewall for specific Microsoft services (like Azure Backup, Azure Monitor), not for on-premises ExpressRoute traffic. D is wrong because routing through a VPN gateway adds unnecessary complexity and changes the architecture away from the ExpressRoute topology.