So from networking/security perspective one thing doesn't add up for me. You have a VNET Injected workspace, but your storage account has public access enabled. This is security risk. You should disable public access and create private endpoints. Then, all your resources will be able to talk privately between each other.