How to secure access to host storage account for Function Apps on Windows Elastic Premium Plan with VNET Integration

Question

Background / Setup:

• Function Apps on Windows Elastic Premium Plan (EP1) with Zone Redundancy and Auto Scaling from 3 to x nodes
• Inbound access control on main site and advanced tool site of the Function App. Deny all for advanced tool site with temporary whitelisting of IP of the deployment agent at the time of new deployments.
• VNET integration for outbound access. Relevant service endpoints enabled on the subnet used for VNET Integration. Target resources (business data storage accounts, Key Vault, SQL Servers, Service Bus etc.) have Network ACLs to allow access through specific subnet used for VNET integration. Access to those target resources is also protected via Managed Identity of Function App (as our aim is to go for secret-less functions).
• The functions are coded in C# on .NET6.
• Function Apps have FUNCTIONS_EXTENSION_VERSION = ~4, FUNCTIONS_WORKER_RUNTIME = dotnet, WEBSITE_CONTENTOVERVNET= 1, have vnetRouteAllEnabled and without multiple deployment slots.
• Zip Deployment through Azure DevOps Pipelines
• Separate Host Storage Account for each Function App on Windows EP1 Plan. Each storage account used is standard, general purpose v2, with ZRS.

Question:

• How to best secure the host storage account for the function app? What's supported from network access control perspective in context of above set up? What's supported from authentication and authorization (account keys based access only OR system assigned managed identity) perspective in context of above set up?

Our preferred solution for this will be:

• Secure the access on Host Storage Account of Each Function through Network ACLs allowing the Subnet that has VNET integration for Function Apps, and IAM/RBAC via Managed Identity of respective Function App (i.e., no need to rotate keys).

Hurdles in our preferred solution:

• Managed identity based access to secure access to host storage account for Function Apps is in Preview. We have tried to make it work in the above setup, but our function app reports errors with it as the setting required for Windows Elastic Premium Plans i.e., WEBSITE_CONTENTAZUREFILECONNECTIONSTRING doesn't support managed identity as yet. So, we haven't explored it further as its still a preview feature (as outlined here [https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob#connecting-to-host-storage-with-an-identity-preview] and [https://github.com/MicrosoftDocs/azure-docs/issues/86604]). So, we have to fall back to typical Storage Account Keys based access to Host Storage Account for each Function App.
• Official documentation from Microsoft to restrict network access to the Host Storage Account of Function App follows a two step process i.e., deploy the function app with a host storage account without any Network ACLs and then move/replace that with a storage account with Network ACLs (as outlined here [https://learn.microsoft.com/en-us/azure/azure-functions/configure-networking-how-to#restrict-your-storage-account-to-a-virtual-network]) We are unable to find any Microsoft Documentation which outlines the logical one step process i.e., when we provision the host storage account for our function apps, we have the Network ACLs on it upfront, as the Function App to use that Host Storage Account has VNET integration anyways. We have tried this one step process, and its functionally working, but we noticed a few errors in the Host Storage Account diagnostic logs for files. So, we are concerned that even though the function is working in test environments, but we may well face issues from a non-functional perspective down the line. Is that one step process not officially supported by Microsoft and we must follow the two step process?

With the above context/background, what's the officially supported way (can be different from our preferred solution) of securing access to host storage account for Function Apps on Windows Elastic Premium Plans with VNET Integration.