Resource instance rules for access to Azure Storage are now in public preview in all Azure public regions.
Some Azure resources cannot be isolated through a virtual network or an IP address rule. However, you'd still like to secure and restrict access to your storage account to only your application's Azure resources. You can now configure your storage accounts to allow access to only specific resource instances of select Azure services by creating a resource instance rule.
Resource instances must be in the same tenant as your storage account, but they may belong any resource group or subscription in the tenant.
Learn more.