Resource Instance rules for access to Azure Storage are now generally available.
This comes into use if you would like to secure and restrict storage account access but cannot isolate the resources through a virtual network or IP address rule. Now you can configure the storage account to permit access only from specific resource instances of Azure services.
Note that resource instances need to be in the same tenant as the storage account but they can belong to any resource group or subscription.