Azure Container Apps: managed-identity Azure Files mount gets GetKerbTicket 403 with storage firewall Deny

I’m testing Azure Container Apps in West US 2 with an Azure Files SMB share in East US.

Configuration:

• VNet-integrated workload profiles environment using Consumption.
• Environment system-assigned managed identity.
• Storage File Data SMB MI Admin assigned at storage-account scope.
• SMB OAuth enabled.
• Storage firewall default Deny.
• Environment subnet allowed through Microsoft.Storage.Global.

The mount fails before container startup. StorageFileLogs shows HTTPS GetKerbTicket requests using OAuth, returning 403 AuthorizationFailure. The requester object ID matches the environment identity.

Temporarily allowing only the observed caller IP makes the mount succeed. All 30 test files passed checksum verification. Removing that exception restores the restricted configuration.

What is the supported, durable network configuration for the GetKerbTicket request? Does this authentication traffic use a platform-managed network path outside the environment subnet? Would a storage private endpoint cover that path?

I want to retain managed-identity authentication and restricted storage access without maintaining an undocumented outbound IP allowlist.