[Premium] Can't deploy Function App to storage account with VNET restriction

Below is an ARM template which creates:

1. Microsoft.Storage/storageAccounts
* A storage account with a VNET ACL (`virtualNetworkRules`)
2. Microsoft.Web/Sites
* A function app using that storage account for `AzureWebJobsStorage` and `WEBSITE_CONTENTAZUREFILECONNECTIONSTRING`
3. Microsoft.Web/Sites/config
* VNET integration for the function app

Resource 2 fails with
```
There was a conflict. The remote server returned an error: (403) Forbidden.
```

[TemplateAndError.zip](https://github.com/Azure/Azure-Functions/files/3727499/TemplateAndError.zip)

I believe the Microsoft.Web ARM provider is attempting connection to the storage account and can't. (I enabled "Allow trusted Microsoft services to access this storage account" but that isn't helping.)

An obvious workaround is to take the ACL out of the storage account, and deploy it a second time later with the ACL applied.

Is there a cleaner workaround? It's a common practice for people to deploy the Function App and Storage Account all in the same template.

See also: https://github.com/Azure/azure-functions-ux/issues/2279