You have a network security group (NSG) bound to an Azure subnetYou run Get-AzNetworkSecurityRuleConf ig...

Statement

Selection

Traffic destined for an Azure Storage account is

able to connect to East US 2

FTP connections from 1.2.3.4 to 10.0.0.10/32 are

dropped

The first selection is able to connect to East US 2 because NSG rules are evaluated in ascending priority order—the lower numerical value has higher priority . The StorageEA2Allow outbound rule has priority 104 and permits traffic to the Storage.EastUS2 service tag on destination port 443 . The broader DenyStorageAccess rule has priority 105 and denies outbound traffic to the general Storage service tag. Because priority 104 is evaluated first, HTTPS storage traffic to East US 2 is allowed; storage traffic for other regions subsequently matches the priority-105 deny rule. Microsoft confirms that regional service tags such as Storage.EastUS2 restrict the tag to the service ' s IP ranges in that specific region. Microsoft Learn

The FTP connection is dropped . The Contoso_FTP inbound rule permits TCP port 21 from 1.2.3.4/32, but only when the destination is 10.0.0.5/32 . The question ' s destination is 10.0.0.10/32, so this custom allow rule does not match. The traffic ultimately reaches the NSG ' s default DenyAllInbound rule and is blocked. Microsoft documents that NSG processing stops on the first matching rule.