Bug in portal when creating a storage account attempts to copy the storage account's tags to the VNet with which it has an endpoint mapping
When creating a storage account via the portal which has tags defined and utilizes a VNet endpoint, the portal attempts to copy the storage account's tags to the VNet. This behavior does not occur with PowerShell or CLI and should not be expected anyway, as tags are specific to each individual resource. This causes additional issues if the customer has Azure Policies in place requiring certain tags on certain resources, as well as VNet endpoints for Storage Accounts, preventing deployment. This can also cause issues if the individual deploying the storage accounts doesn't have rights to update the VNet's tags. Tags specified on a storage account at deployment time should apply only to that storage account and not other resources.
Repro: When capturing network traffic via the browser, we see that if no tags are defined then the template sent to the API only contains the Storage Account configuration. But if tags are defined, the request to the API also includes the entire VNet configuration with the storage account's tags added to it.
Thanks for the feedback. This has been routed to the appropriate Service group for further review.