Restricting the network and managing account keys

A company has just created its first Azure storage account to host accounting exports. A week later, whoever is watching the access logs notices connection attempts from IP addresses nobody recognises. Nothing was read or changed, but the reason is…