Storage Accounts - Networking

Hi All,

Seems like a basic issue, however, I cannot seem to resolve the issue.
In a nutshell, a number of storage accounts (and other resources) were created with the Public Network Access

set as below:

I would like to change them all to them all to Enabled from selected virtual networks and IP addresses  or 
even Disabled. 

However, when I change to Enabled from selected virtual networks and IP addresses, connectivity from, for example,
Power Bi to the Storage Account fails. I have added the VPN IP's my local IP etc.
But all continue to fail connection or authentication. Once it is changed back to Enabled for All networks everything works, i.e. Power Bi can access the Azure Blob Storage  and refresh successfully.

I have also enabled 'Allow Azure services on the trusted services list to access this storage account'.

But PBI fails to have access to the data. data Source Credentials error, whether using Key, Service Principal etc, it fails. As soon as I switch it back to Enable From All Networks, it authenticates straight away.
One more idea I had was to add ALL of the Resource Instances, as this would white list more Azure services, although PBI should be covered by enabling 'Allow Azure services on the trusted services list to access this storage account'. I thought I might give it a try.
Also, I created an NSG and used the ServiceTags file to create an inbound rule to allow Power BI from UK South.

Also, I have created a Private Endpoint.
This should all have worked but still can’t set it to restricted networks. I must be missing something fundamental or there is something fundamentally off with this tenant.

When any of the two restrictive options are selected, do they also block various Microsoft services?
Any help would be gratefully appreciated.