azure vnet service endpoint what happens when you turn it on and how do you whitelist your resources?

This questions might sound hard but it is quite easy to answer. When we enable service endpoint for storage acccount or other resources, we will be using microsoft backbone to route request to the storage account. When this happens, we no longer using a NAT and hence our public IP might not be whitelisted. 

In that case, how do you whitelist it? Simple, just use the subnet that your resources resides in.