L10. Private Access to PaaS: Private Endpoints, Private Link, Azure Firewall & Network Watcher

Azure Private Endpoints

A private endpoint provisions a network interface with a private IP address, from your own VNet's address space, that maps directly to a specific PaaS resource instance (a storage account, SQL server, Key Vault, etc.). Once configured, traffic to that resource never traverses the public internet, and public network access to the resource can be disabled entirely so the private endpoint becomes the only path in. Private DNS zone integration is what makes this transparent to applications: the resource's standard hostname (e.g., mystorageacct.blob.core.windows.net) resolves to the private IP instead of the public one when queried from within the VNet, linked to the VNet through a private DNS zone, so no application code or connection string needs to change to start using the private path.

Azure Private Link Service

Where a private endpoint consumes someone else's PaaS service privately, Azure Private Link service lets you expose your *own* service (running behind a Standard Load Balancer) to be consumed privately by others, including other Azure customers or other VNets in your own organization, without their traffic needing to traverse the public internet or requiring VNet peering between the provider and consumer.

Azure Firewall

Azure Firewall is a managed, stateful network and application layer firewall:

• Network rules filter by IP/port/protocol (layer 3-4)
• Application rules filter by FQDN, useful for allowing outbound access to specific SaaS domains without opening broad IP ranges that change over time
• DNAT rules translate and filter inbound traffic destined for the firewall's public IP to a private backend
• Firewall Policy centralizes rule collections and can be applied across multiple firewall instances, including the firewall inside a secured virtual hub from the previous lesson
• Threat intelligence-based filtering can alert or block traffic to/from known malicious IPs and domains using Microsoft's threat intelligence feed
• Premium tier adds TLS inspection (decrypting and inspecting outbound HTTPS traffic) and IDPS (intrusion detection and prevention using signature-based network threat detection), both unavailable in the Standard tier

Azure Network Watcher

Network Watcher provides diagnostic tools to verify what's actually happening on the network, rather than what the configuration claims should happen:

• IP flow verify: checks whether a specific packet (source/destination IP and port, protocol) would be allowed or denied, and which rule is responsible for that result
• Effective security rules: shows the fully merged, actually-in-effect set of NSG rules for a given NIC, combining subnet-level and NIC-level NSGs plus default rules, since the rule that looks correct in one NSG can still be overridden by another applied elsewhere
• Connection troubleshoot: tests actual reachability between two endpoints and reports where in the path a connection fails
• Flow logs: capture accepted/denied traffic through an NSG (or through Azure Firewall) over time, feeding into Traffic Analytics or a SIEM like Sentinel for historical analysis rather than a point-in-time check

Exam tip: "Evaluate effective security rules" is explicitly named in the SC-500 skills outline: the exam is testing whether you know that the *effective* rule set (Network Watcher's merged view) is what actually determines traffic behavior, not any single NSG viewed in isolation.