Hi Team,

I’m encountering an issue with my architecture.
I’m using VNet Injection and serverless with NCC. Our organization has a firewall controlling both inbound and outbound traffic.

I want to restrict all traffic to private networks only, but I ran into a problem during JOB COMPUTE operations.
To run this resource, it needs to connect to:

abfss://root@dbstorageXXXXXXXXX.dfs.core.windows.net

This is a default storage account created in the managed resource group. I cannot disable public access or add a Private Endpoint due to

Is there a way to work around this?
Is it even possible to achieve full private network isolation in this scenario?