Access Azure Storage account cross tenant

Question

The problem statement is, I have an application that resides in consumer tenant and a storage account that resides in provider tenant. My application needs to access this storage account. Moreover, this storage account does not have public network access enabled.

My approach is this:

Provider tenant:

1. Ensure storage account's version is v2 since private endpoints are not supported on v1.
2. Save the resource ID of storage account.

Consumer tenant: let us suppose the application that needs access to storage account is in eastus2 region.

1. Create a virtual network with a subnet in eastus2 region.
2. Create a private dns zone.
3. Link the vnet with the private dns zone.
4. Create a private endpoint with resource ID of the storage account in provider tenant. Ensure it is created in eastus2 region itself.
5. Configure dns zone settings of private endpoint and point the config to the vnet created in eastus2 region above.
6. Create an "A" record inside recordsets where name is the storage account's name.The problem statement is, I have an application that resides in consumer tenant and a storage account that resides in provider tenant. My application needs to access this storage account. Moreover, this storage account does not have public network access enabled. My approach is this: Provider tenant:
   1. Ensure storage account's version is v2 since private endpoints are not supported on v1.
   2. Save the resource ID of storage account.
   Consumer tenant: let us suppose the application that needs access to storage account is in eastus2 region.
   1. Create a virtual network with a subnet in eastus2 region.
   2. Create a private dns zone.
   3. Link the vnet with the private dns zone.
   4. Create a private endpoint with resource ID of the storage account in provider tenant. Ensure it is created in eastus2 region itself.
   5. Configure dns zone settings of private endpoint and point the config to the vnet created in eastus2 region above.
   6. Create an "A" record inside recordsets where name is the storage account's name.

For example, if storage account name is myStorage, then the record is an entry for myStorage.privatelink.blob.core.windows.net with private ip of vnet.

Now go back to provider tenant:

1. Approve the pending private endpoint connection from consumer tenant
2. Go to the storage account -> private endpoints
3. Should see the same endpoint that was created in consumer.

I have testing this approach and I see that my application is able to list the storage contents when storage account's networking options has cut off public access completely.

Traffic is going via Microsoft backbone network only.

What I realized with this approach is that, I need to create a private endpoint for each storage account I want to access in provider tenant. This leads to multiple endpoints and its associated costs.

What are alternative approaches?