The answer can be found here. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview Pricing and limits There's no extra charge for using service endpoints. The current pricing model for Azure services (Azure Storage, Azure SQL Database, etc.) applies as-is today. There's no limit on the total number of service endpoints in a virtual network. Certain Azure services, such as Azure Storage Accounts, may enforce limits on the number of subnets used for securing the resource. Refer to the documentation for various services in the Next steps section for details. https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/security/security-service-tags An Azure service tag represents a group of IP addresses from/to which traffic from a specific service may come, which allows you to set up firewalls for a specific service to allow only traffic from certain services. Answer = VNET = Service Endpoint NSG = Service Tag

2nd answer is wrong. It should be service tag. NSG: Service Tag Nsg and route table are 2 different things

VNet1: service endpoint NSG1: service tag (Internet) within a deny inbound rule