how to lock down the access to speech resource to Speech portal only?

Question

how to lock down the access to a speech resource so that only Speech portal (speech.microsoft.com) would get access to it?
Currently the resource requires "access from all networks". This is against our policy. How can we lock this down? I did not find a suitable IP adress range which worked. What is best practice?
A private endpoint probably cannot be used, but what else?
We need the resource only for Content creation (text to speech with SSML)

Answer 1

@Klaus Zuenkler I believe this query is similar to the thread we discussed earlier. I am referencing the same here for visibility and posting my last response as answer here.

The list for all Azure are available for download from here. The cognitive services area uses the IPs under CognitiveServicesManagement. This list is dynamic and could change from time to time, if you are planning to block access with the IP list. Depending on your region you can lookup your IP with nslookup and check if the IP is available in the downloaded list. The IP returned in my case is available in the list so you can do a quick check by blocking the IP you see with lookup. I hope this helps.