I have an Azure ARM template that deploys (amongst other things) a storage account.

The storage account needs to be accessible by several services (and only by them), but the mixture of services varies per deployment and is not known at the time of deployment. It is also possible to deploy another service on the fly.
virtualNetworkRules items require a subnet ID, defined in each of the separate services’ templates.

My question is: Is there any way to add a virtualNetworkRules entry entirely in an ARM template that updates an existing storage account, without overwriting the existing rules?

{
    "type": "Microsoft.Storage/storageAccounts",
    "name": "<regional account>",
    "location": "[resourceGroup().location]",

    "kind": "StorageV2",
    "properties": {
        "accessTier": "Hot", 
        "dnsEndpointType": "Standard", 
        "publicNetworkAccess": "Disabled", 
        "allowSharedKeyAccess": false,
        "networkAcls": {
            "bypass": "AzureServices",
            "virtualNetworkRules": [
                // not known at time of deployment
            ], 
            "ipRules": [],
        },
        "supportsHttpsTrafficOnly": true,      
}

Each service deploys its own VNet, NSGs etc

{
    "type": "Microsoft.Network/networkSecurityGroups", 
    "name": "<different per service>>",
    "location": "[resourceGroup().location]",
    ....
    "properties": {
        "subnets": [
            {
                "id": "<maybe one>"
            },
            {
                "id": "<maybe more>"
            }
            ....
        ],
    }
}
{
   //... can I update the 'virtualNetworkRules' from here?
}