A profile-share requirement explicitly says the file service must have a private IP reachable from host VNets. A service endpoint has been enabled, but the hostname still reaches the public file service. What meets the private-IP requirement?

✓ Correct answer

• Create a private endpoint for the file subresource and configure its private DNS resolution

Use the storage account's file private endpoint for this requirement. Continue using the normal UNC hostname with DNS resolving to the private address. Option explanations: A. Create a private endpoint for the file subresource and configure its private DNS resolution: A file private endpoint provides a private IP and needs the corresponding name-resolution path. B. Create only the AVD host-pool connection endpoint: That endpoint serves AVD sessions and does not also privatize Azure Files. C. Assign Storage File Data SMB Share Elevated Contributor to every user: A data role does not implement private network addressing. D. Keep only the service endpoint because it assigns a private IP: A service endpoint restricts access to a public service endpoint; it does not assign a private file-service IP. Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid; Create an Azure classic file share — https://learn.microsoft.com/en-us/azure/storage/files/create-classic-file-share

Read the source reference