By default, storage accounts have public endpoints that are accessible from the internet. To restrict access to a specific subnet in an existing VNet using service endpoints, complete the following steps. Read more about How to Restrict Network Access Using Service Endpoints