Contoso wants to ensure only two specific Storage Accounts (stg01 and stg02) in their subscription can be accessed from a finance subnet over the Microsoft backbone. They plan to use Service Endpoints with an additional restriction. Which configuration will restrict access from the subnet to only those storage accounts?

The correct option leverages Service Endpoint Policies (SEPs) to achieve granular control. Enabling the Microsoft.Storage service endpoint on the subnet routes traffic to Azure Storage over the Microsoft backbone. The SEP, explicitly listing the resource IDs of stg01 and stg02, then restricts access from that subnet only to those specified storage accounts, even though the service endpoint is enabled for all storage. The other options are incorrect because: NSG rules operate at the IP level and cannot differentiate between specific storage accounts within the Microsoft.Storage service endpoint. Private Endpoints provide private connectivity but are not designed to restrict access from a subnet to only specific instances of a service while still using the public endpoint for other services. They create a dedicated private IP for each resource. Storage account firewalls filter incoming connections to the storage account itself, not outgoing connections from a subnet. While they can restrict access to the storage account, they don't restrict what a subnet can access.