Add 101-standard-service-endpoint-storage quickstart sample

[asudbring]

Adds a quickstart sample for a standard service endpoint for Azure Storage.

A standard service endpoint connects IaaS workloads to PaaS resources using a network identifier (a public IP address) and a network security perimeter, rather than subnet-scoped ACLs. This addresses the scale limits of basic service endpoints: one public IP can represent many virtual networks and subnets in the same region and subscription.

Sample directory: quickstart/101-standard-service-endpoint-storage/

Resources

Resource	Purpose
Virtual network and subnet	Hosts the IaaS workload
Public IP prefix and public IP	Network identifier for the service endpoint
Subnet service endpoint (azapi)	Associates the network identifier with Microsoft.Storage
NAT gateway and public IP	Outbound connectivity for the VM
Linux VM and NIC	IaaS workload, private IP only
Storage account and file share	PaaS resource behind the endpoint
Network security perimeter, profile, association	Secures the storage account
Perimeter inbound access rule	Authorizes the network identifier prefix

Notes for reviewers

• The subnet is created with the azapi provider because the service endpoint networkIdentifier property is not exposed by azurerm. It is available in the stable ARM API Microsoft.Network/virtualNetworks/subnets@2025-07-01.
• Standard service endpoint is in public preview behind the AllowServiceEndpointNetworkIdentifier feature flag. The readme documents the self-serve registration commands. CI will need this feature registered on the test subscription, or this sample will fail to deploy. Happy to hold this PR until the feature is GA if that is preferred.
• The perimeter association defaults to Learning mode (logs, does not block), which is the recommended starting posture. nsp_access_mode can be set to Enforced.
• Default location is eastus2.

Verification

terraform apply and terraform destroy run against a subscription with the preview feature registered.

• 21 resources created, 21 destroyed, resource group confirmed removed.
• Subnet service endpoint after apply:

{
  "service": "Microsoft.Storage",
  "networkIdentifier": {
    "id": ".../providers/Microsoft.Network/publicIPAddresses/public-ip-1"
  },
  "provisioningState": "Succeeded"
}

• Perimeter association: assoc-storage, mode Learning, state Succeeded.
• Perimeter inbound rule: allow-se-standard, direction Inbound, prefix matching the allocated network identifier range.

terraform fmt applied; terraform validate passes.

---

Revision history

The initial revision of this PR configured a basic virtual network service endpoint (subnet.service_endpoints plus storage network rules) and named it after the standard service endpoint feature. Those are different features. The sample has been rewritten to implement the standard service endpoint, and the directory renamed accordingly.

[asudbring]

Companion Terraform quickstart article PR: MicrosoftDocs/azure-docs-pr#319044 (internal). The article references this sample via quickstart/101-service-endpoint-storage.