Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Azure Monitor is one of the services classified by Microsoft as a "trusted Microsoft service." When the setting "Allow trusted Microsoft services to bypass the firewall" is enabled on a storage account, these services can reach the account even when public network access is denied and only selected VNets are allowed. Service endpoint policies do not allow a service itself to bypass a storage firewall. Adding Azure Monitor's public IP ranges is unnecessary and brittle, because IPs may change. Enabling Private Link for the storage account would require Azure Monitor to also use a Private Endpoint, which it does not; therefore, it would block the ingestion path. Enabling the trusted-service bypass is the only configuration that satisfies the requirement.