You have an Azure subscription that contains a storage account named storage1 and a virtual machine named VM1. VM1 is connected to a virtual network named VNet1 that contains one subnet and uses…

Disabling public network access for storage1 would prevent public access but does not establish a private connection; a private endpoint is still required for private IP access.

Creating a new subnet on VNet1 does not inherently provide private IP connectivity to an Azure Storage account; a private endpoint is specifically designed to establish this private link.

Creating a new private endpoint for storage1 establishes a private link to the storage account within VNet1, allowing VM1 to connect directly using a private IP address, and automatically integrates with Azure DNS for resolution, minimizing administrative effort.

While an Azure Private DNS zone is often used for custom DNS resolution with private endpoints, the fundamental action to enable private IP connectivity to the storage account is creating the private endpoint itself, which handles the necessary DNS integration by default with Azure DNS.