In an Azure subscription with VMs connected to VNet1, to configure Azure Monitor for VM Insights ensuring VMs communicate exclusively through VNet1, what must be created initially?