Cram sheet — Configure secure access to virtual networks

Security groups have an evaluation order worth knowing exactly, and the two ways of reaching a platform service privately are routinely offered as though they were interchangeable. They are not.

How a network security group decides

• Priority is a number between 100 and 4096, and lower numbers are processed first. Once traffic matches a rule, processing stops — later rules with the same attributes never run.
• Azure's default rules sit at the lowest priority (highest number) precisely so your custom rules are always evaluated first. AllowVNetInBound is at 65000.
• ⚠ You cannot remove the default rules. You can only override them with a higher-priority rule.
• You cannot create two rules with the same priority and direction.
• ⚠ A security group is stateful. A flow record is kept for existing connections, so allowing outbound on a port means the response comes back without a matching inbound rule, and vice versa. Adding the return rule is the classic wrong answer.

Application security groups have one hard constraint

• ⚠ Every network interface in an application security group must be in the same virtual network as the first interface added to it. You cannot add interfaces from different virtual networks to one group.
• To deny traffic between resources in a network you must write an explicit deny, because the AllowVNetInBound default already permits all communication inside the virtual network.

Bastion

• Connecting through Bastion means your VMs need no public IP address, no agent and no special client software.
• Basic, Standard and Premium require a dedicated subnet named AzureBastionSubnet and a public IP address. Premium additionally supports a private-only deployment with no public IP, and the Developer SKU uses shared infrastructure and needs no virtual network at all.

Service endpoint or private endpoint — they do different things

• ⚠ With a service endpoint, traffic switches from public to private source addresses — and therefore existing service firewall rules written against your public IPs stop working. That break is the single most examined consequence in this topic.
• A private endpoint's read-only network interface is created automatically for its lifetime, and its private IP does not change while the endpoint exists.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.