Accessing log stream when private endpoints or access restrictions are enabled:
If you are trying to access the log stream through the portal and the app service has a private endpoint/access restriction enabled, then check whether the log stream is accessed from the same network (in case a private endpoint is enabled) or from the whitelisted network (in case access restriction is enabled).
In either of the above scenarios, you should be able to access the log stream from a VM that is connected to the same network.
Lastly, since Log Streaming uses KUDU, make sure you have also allowed https://<app-name>.scm.azurewebsites.net in your NSG and any other areas. Simply allowing your app-name.azurewebsites.net URL will not be enough.