Grant AKS access to Postgres database in Azure via VNet

Trying to figure out how to best give my AKS cluster access to a Postgres database in Azure.

This is how I create the cluster:

az group create \
  --name $RESOURCE_GROUP \
  --location $LOCATION

az aks create \
  --resource-group $RESOURCE_GROUP \
  --name $CLUSTER_NAME \
  --node-vm-size Standard_DS2_v2 \
  --node-count 1 \
  --enable-addons monitoring \
  --enable-managed-identity \
  --generate-ssh-keys \
  --kubernetes-version 1.19.6 \
  --attach-acr $ACR_NAME \
  --location $LOCATION

This will automatically create a VNet with a subnet that the node pool uses.

The following works:

1. Find the VNet resource in Azure
2. Go to "subnets" -> select the subnet -> Choose "Microsoft.SQL" under "Services". Save
3. Find the Postgres resource in Azure
4. Go to "Connection Security" -> Add existing virtual network -> Select the AKS VNet subnet. Save

So I have two questions:

1. Is it recommended to "fiddle" with the VNet subnet automatically created by az aks create? I.e adding the service endpoint for Micrsoft.SQL
2. If it's ok, how can I accomplish the same using Azure CLI only? The problem I have is how to figure out the id of the subnet (based on what az aks create returns)