Looking into it. Thanks.
VNET tunneling is on the backlog, but there are dependencies for Azure AS to talk to other cloud services on the VNET. We don't have timeline for this yet.
However, we are implementing a feature that will be ready soon, which will provide a workaround. We will create a property on an Azure AS server to always go through a gateway to get data - including cloud sources such as Azure DW, etc. If the gateway machine is in the VNET, it is not necessary to open up access on the data sources for Azure AS.
Firewall is already done to prevent user access.
This is available in the new web designer currently: https://azure.microsoft.com/en-us/blog/introducing-the-azure-analysis-services-web-designer/.
Would Azure Active Directory B2B support satisfy this request?