Network Security Group (NSG) flow logs, a feature of Azure Network Watcher, allows you to view information about ingress and egress IP traffic. In response to requests in the Azure Networking forums, this feature now supports two new Azure Storage configurations:
Firewalled Storage accounts
Configuring Storage firewalls provides greater access control and security of your data. NSG flow logs can now be sent to storage accounts with a firewall enabled.
Service endpoints for Storage
Azure Virtual Network service endpoints allow you to control how your network interacts with Azure, ensuring that traffic from your virtual network to Azure services remains on the Azure backbone network. NSG Flow Logs can now be sent to Storage accounts accessible through virtual network service endpoints.
Learn more from the NSG flow logs FAQ.