Unable to backup APIM instance to storage account

For APIM backup to a locked-down storage account, I would separate identity/RBAC from network reachability.

Identity side:

1. The APIM managed identity needs Storage Blob Data Contributor on the target storage account or container.
2. The identity running the PowerShell/REST backup call also needs permission to trigger the APIM backup operation.
3. Confirm you are using the managed identity mode in the request, not accidentally falling back to access key/SAS behavior.

Network side:

1. Service endpoint on the APIM integration subnet is not always enough if the backup operation is performed by the APIM control plane rather than traffic originating exactly like normal subnet traffic.
2. If public network access is disabled, test whether a private endpoint for blob plus correct private DNS is required for the storage path you are using.
3. The trusted Microsoft services checkbox is not a blanket allow for every Azure service/control-plane operation, so I would not rely on it as proof APIM backup can reach the account.

As a quick isolation test, temporarily allow the storage account from selected networks plus the relevant subnet/public path, run one backup, then lock it down again. If that works, the remaining issue is storage firewall/private endpoint path rather than RBAC.

Docs:
https://learn.microsoft.com/azure/api-management/api-management-howto-disaster-recovery-backup-restore
https://learn.microsoft.com/azure/storage/common/storage-network-security