According to the NSG security rules mentioned in Baseline highly available zone-redundant web application, security rule for allowing outbound access to AppServiceSubnet is missing. Additionally, the naming convention used for outbound access from AppGateway (AppPlan.Out.Allow.AzureMonitor) to Azure Monitor seems to differentiate compared to other names used within the same NSG.