Secure storage, databases, and networking
Azure Network Security Controls
CoreBuild enforceable network boundaries with segmentation, centralized policy, hybrid connectivity, identity-aware private access, Private Link, firewall inspection, and path diagnostics.
Aligned to the live SC-500 guide, which publishes no skills-measured date; guide and product behavior verified September 23, 2026.
Why this matters
Azure network controls overlap but are not interchangeable. The right answer depends on traffic direction, scope, protocol, identity, whether a service is consumed or published, and where policy must be centralized.
Must Know
- NSGs filter traffic at subnet or network-interface scope; ASGs group VM network interfaces so rules can use application roles instead of individual IP addresses.
- Azure Virtual Network Manager can centrally apply security admin rules and network group policy across managed virtual networks; evaluate its scope and precedence separately from local NSGs.
- Virtual WAN centralizes branch, VPN, ExpressRoute, routing, and secured-hub designs. A VPN still needs correct gateway, tunnel, route, and cryptographic settings on both sides.
- Microsoft Entra Private Access provides identity-aware access to configured private applications; it is not a general replacement for every site-to-site network connection.
- A private endpoint is a consumer-side network interface for a PaaS resource. A Private Link service publishes a provider service behind a Standard load balancer for private consumption.
- Azure Firewall is a stateful managed firewall with network, application, and NAT rules; forced tunneling and routing determine whether traffic actually traverses it.
- Network Watcher effective security rules, IP flow verify, next hop, connection troubleshoot, and packet capture answer different path questions.
Compare and Distinguish
- NSGs provide distributed layer 3/4 filtering; Azure Firewall adds centralized stateful inspection and application-aware policy.
- A private endpoint consumes a service privately; a Private Link service exposes a provider-owned service privately.
- VPN supplies a network tunnel; Entra Private Access grants identity-aware access to specific private applications.
Scenario examples
- Scenario: All managed virtual networks must deny one malicious range even if local administrators change NSGs. Think: use a centrally scoped security admin rule.
- Scenario: Consumers in other virtual networks need private access to a custom service behind a load balancer. Think: publish a Private Link service and approve private endpoints.
- Scenario: A packet is denied despite an apparently permissive NSG. Think: inspect effective rules, next hop, routes, and the opposite traffic direction.
Exam traps
- An ASG is a grouping primitive used by NSG rules; it does not filter traffic by itself.
- Creating a private endpoint without correct private DNS may leave clients resolving the public address.
- Azure Firewall cannot inspect traffic that routing sends around it.
- IP flow verify evaluates a selected flow against effective rules; it does not establish a VPN tunnel or repair routing.
Key takeaways
- Choose controls from traffic path, direction, ownership, scope, and inspection needs.
- Private connectivity still requires DNS, routing, approval, and service authorization.
- Use Network Watcher evidence before changing multiple controls at once.
How it works
- Azure computes routes and effective security rules at interfaces and subnets, then forwards traffic through any configured gateways or firewalls.
- Private Link maps a private consumer address to a service while Microsoft Entra and the service still enforce access.
Objects and administrative surfaces
- NSGs, ASGs, security rules, effective rules, route tables, and network interfaces.
- Virtual Network Manager network groups and security admin configurations; Virtual WAN hubs, gateways, connections, and route tables.
- Private endpoints, private DNS zones, Private Link services, Azure Firewall policies, and Network Watcher diagnostics.
When to use it
- Use centralized security admin rules for organization-wide guardrails and NSGs for workload segmentation.
- Use Network Watcher to test a specific suspected rule, route, or connection before broad policy changes.
Security and governance implications
- Separate central network-policy ownership from workload rule administration and protect firewall policy changes.
- Review broad inbound rules, public endpoints, unapproved private connections, route changes, and stale VPN credentials.
Troubleshooting signals
- Check DNS, route, effective rule in both directions, appliance health, and target authorization in sequence.
- For VPN failure, compare peer addresses, IKE/IPsec parameters, shared key or certificate, BGP, and route propagation on both ends.
More detail
- Author minimal NSG rules with ASGs and verify effective outcomes.
- Apply centralized Virtual Network Manager policy and secure Virtual WAN connectivity.
- Select VPN, Entra Private Access, private endpoint, or Private Link service for the access pattern.
- Route through Azure Firewall and diagnose decisions with Network Watcher.
Ready for the quiz?
- When is a Private Link service required instead of a private endpoint alone?
- Which tool shows the combined NSG rules effective on a network interface?
- Why can an Azure Firewall policy exist without seeing the intended traffic?
Related objectives
- D2.3.S1 — Implement and manage network security groups (NSGs) and application security groups (ASGs)
- D2.3.S2 — Implement and configure network access policies by using Azure Virtual Network Manager
- D2.3.S3 — Configure security for an Azure Virtual WAN
- D2.3.S4 — Implement and configure security for virtual private network (VPN) connections
- D2.3.S5 — Implement and configure Microsoft Entra Private Access
- D2.3.S6 — Configure Azure private endpoints to secure access to Azure platform as a service (PaaS) resources
- D2.3.S7 — Configure Azure Private Link services to secure access to network resources
- D2.3.S8 — Implement and configure Azure Firewall
- D2.3.S9 — Evaluate effective security rules by using Azure Network Watcher diagnostics