This is a continuation of IaC shortcomings and resolutions. In Azure, a storage account without private endpoints can be accessed by compute resources that do not have public IP addresses through the use of Azure's internal networking capabilities. Here's how it works:

1. Virtual Network (VNet): Both the storage account and the compute resources reside within an Azure VNet, which is a private network within Azure.

2. Service Endpoints: While private endpoints are not used, we can enable service endpoints for Azure Storage within the VNet. This allows us to secure our storage account so that it can only be accessed from specific subnets within the VNet.

3. Network Security Groups (NSGs): NSGs are used to control inbound and outbound traffic to network interfaces (NIC), VMs, and subnets. We can configure NSGs to allow traffic between the compute resources and the storage account within the VNet.

4. Azure Bastion: For secure, remote access to the compute resources from outside the VNet, we can use Azure Bastion, which provides RDP and SSH connectivity via the Azure portal without the need for public IP addresses.

5. VPN Gateway or ExpressRoute: To connect to the Azure VNet from on-premises networks securely, we can use a VPN Gateway or ExpressRoute with private peering. This allows on-premises compute resources to access the Azure storage account as if they were part of the same local network.

6. DNS Configuration: Proper DNS configuration is necessary to resolve the names of the storage account for the compute resources within the Azure VNet. Azure provides DNS services that can be used for name resolution within VNets. A compute resource from a different virtual network can reach the storage account via the private endpoint, provided the necessary dns configuration is in place and the virtual networks are peered or there is line-of-sight private ip routing between the caller and the callee.

7. Outbound Connectivity: If the compute resources need to access the internet, we can configure outbound connectivity using Azure NAT Gateway or Load Balancer outbound rules, even if the compute resources don't have public IP addresses.

By configuring the VNet, NSGs, and DNS settings correctly, and using service endpoints, we can ensure that compute resources without public IP addresses can securely access an Azure storage account without private endpoints. This setup maintains the security and isolation of our resources within Azure while allowing necessary communication between them.