As App1 is public-facing we need an incoming security rule, related to the access of the web servers.
Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier.
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

https://learn.microsoft.com/en-us/azure/active-directory/external-identities/tutorial-bulk-invite?
source=recommendations

To create an Azure Storage account that supports Azure Data Lake Storage, you need to enable the hierarchical namespace option. This option allows you to organize and manipulate files and folders efficiently in a data lake. It also enables compatibility with the Hadoop Distributed File System (HDFS) API, which is widely used for big data analytics. For more information, see Azure Data Lake Storage Gen2 Introduction.
To minimize costs for infrequently accessed data, you can choose the Cool access tier for your storage account. This tier offers lower storage costs than the Hot access tier, but higher access and transaction costs.
The Cool access tier is suitable for data that is infrequently accessed or modified, such as short-term backup, disaster recovery, or archival data. Data in the Cool access tier should be stored for at least 30 days. For more information, see Access tiers for blob data.
To automatically replicate data to a secondary Azure region, you can choose the geo-redundant storage (GRS) option for your storage account. This option replicates your data synchronously three times within the primary region, and then asynchronously to the secondary region. GRS provides the highest level of durability and availability for your data, and protects against regional outages or disasters. For more information, see Data redundancy.