Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet.