- Storage account with publicNetworkAccess: ‘Disabled’
- Private DNS zone privatelink.blob.${environment().suffixes.storage}
- A virtualNetworkLinks entry linking it to your VNet (or hub)
- The private endpoint with groupIds: [‘blob’]
- A privateDnsZoneGroups child on the endpoint so Azure manages the A record for you
The part most people miss or mess up is setting up forwarding zones from on-prem.
Your conditional forwarders should be for blob.core.windows.net (note the excluded privatelink subdomain).
This is because upstream recursive resolvers may try to resolve the initial domain, and will return a result before your DNS server gets a chance to perform forwarding on the privatelink domain.