To allow on-premises services access to Azure storage account, without exposing the storage account to the internet, you can:
- Set up a VPN from on-premises to Azure
- Configure a storage account private endpoint.
VPN -> Azure Cloud + access public Azure services (without traversing the internet) = Private endpoint.
Resolve a FQDN to an IPv6 address with AAAA DNS record.
To ensure that only certain VMs in your Azure environment can resolve FQDNs to IPs in Azure-hosted DNS zone:
- Deploy the VMs in a single virtual network and allow the virtual network access to the private DNS zone
- Create a private DNS zone