There is a feature in public preview for Azure services that don't have the ability to run inside a traditional Azure VNET. Currently this is only available for Synapse, but will be expanded to other services. You can add access for your Synapse workspace on the network tab of your storage account. You will still need to assign the Synapse managed identity to the 'Storage Blob Data Contributor' role on the storage account to allow it to access data.