You have an on-premises network named Site1. You have an Azure subscription that contains a virtual network named VNet1 and a storage account named storage1. Site1 and VNet1 are connected by using a S

An Azure Application Gateway is a web traffic load balancer and web application firewall; it is not designed to provide private connectivity from on-premises networks to Azure Storage accounts.

An Azure Private Link service is used to expose your own service in a private VNet to consumers in other VNets or on-premises networks, not for connecting to Microsoft PaaS services.

A service endpoint extends the virtual network private address space to the PaaS service (e.g., Storage), allowing VNet resources to access the service over the Azure backbone, but it doesn't automatically enable direct access from on-premises over an S2S VPN tunnel without additional complex DNS or routing configurations for private resolution.

A private endpoint brings Azure services (like Storage Accounts) into your private virtual network, making them accessible via a private IP address within VNet1. This allows on-premises servers, connected via the S2S VPN, to resolve the storage account's private IP and access it securely and privately over the VPN tunnel, minimizing administrative effort by avoiding complex routing or public endpoint exposure.