Secure Networking
Segmentation primitives
Network security groups filter traffic at the subnet or NIC using five-tuple rules evaluated by priority (lowest number first), ending in default rules AllowVNetInBound (65000), AllowAzureLoadBalancerInBound (65001), DenyAllInBound (65500) and matching outbound defaults. Default rules cannot be deleted, only overridden by lower-numbered rules. Application security groups let you group NICs by workload instead of IP ranges. Azure Firewall is a stateful, centralized service with FQDN filtering, threat intelligence, DNAT, and - in Premium - TLS inspection and IDPS. WAF on Application Gateway or Front Door protects HTTP(S) with OWASP rule sets and bot protection. Choose NSG for basic L3/L4 filtering, Firewall for centralized egress control and logging, WAF for web workloads.
Private connectivity
Service endpoints keep traffic on the Azure backbone, but the PaaS resource still has a public endpoint. Private Endpoints allocate a private IP in your VNet via Private Link and are the strongest isolation; they need matching private DNS zones or clients resolve the public name. Azure Bastion replaces public RDP/SSH jump hosts.
Routing and inspection
User-defined routes and forced tunneling push traffic to an NVA or firewall for inspection; UDRs do not automatically apply to Azure service traffic. The GatewaySubnet must not be blocked by an NSG in a way that breaks gateway traffic.
Rule of thumb. "If the PaaS resource has a public endpoint, the answer is Private Endpoint plus private DNS plus disabling public network access." Traps: VNet peering is not transitive; Azure Firewall Basic lacks TLS inspection; DDoS Network Protection is per-VNet while IP Protection is per-IP; NSG flow logs live in Network Watcher, not the NSG blade.