storageAccounts virtualNetworkRules validation fails for cross-tenant subnet

[KenBenjamin]

The following preflight error is returned if using a resource identifier that refers to another tenant:
Error: Code=InvalidValuesForRequestParameters; Message=Values for request parameters are invalid: networkAcls.virtualNetworkRules[*].id. For more information, see - | https://aka.ms/storagenetworkruleset

Using PowerShell Add-AzStorageAccountNetworkRule works correctly, as do same-tenant resource Ids.

This is a required and documented use case: "IP network rules have no effect on requests originating from the same Azure region as the storage account. Use Virtual network rules to allow same-region requests."

Virtual network rules goes on to say: "The allowed subnets may belong to a VNet in the same subscription, or those in a different subscription, including subscriptions belonging to a different Azure Active Directory tenant."