Skip to main content

Azure Networking for DBAs

The Network Architecture You Need to Know

Azure SQL Network Security Architecture
Network Architecture
🔒
Private Endpoint
Private IP in your VNet. Highest security. Public endpoint can be disabled entirely.
🛡️
Service Endpoint
Subnet-level trust via Azure backbone. Public IP still exists. Legacy approach.
🧱
Firewall Rules
IP allowlisting for specific client IPs. Good for dev/test admin access.
⚠️
Allow Azure Services
Any Azure service can connect (0.0.0.0 rule). Avoid in production — overly broad.

Connectivity Options for Azure SQL

MethodSecurity LevelHow It WorksWhen to Use
Private EndpointHighestPrivate IP in your VNetProduction — no public exposure
VNet Service EndpointHighSubnet-level trust, public IPLegacy — prefer Private Endpoint
Firewall RulesMediumIP allowlistingDev/test, admin access from specific IPs
Allow Azure ServicesLowAny Azure service can connect⚠️ Avoid in production

Private Endpoint vs Service Endpoint

Private Endpoint vs Service Endpoint
🔒
Private Endpoint
Private IP inside your VNet (10.0.x.x). Traffic never leaves Azure backbone. Public endpoint can be fully disabled. DNS via Private DNS Zone.
🛡️
Service Endpoint
Traffic routed via Azure backbone BUT SQL server still has a public IP. Subnet-level filtering only. Cannot disable public access.
🎯 Exam Focus

The critical difference: Service Endpoints route traffic via Azure backbone but the SQL server still has a public IP. Private Endpoints give you a private IP inside your VNet — the SQL server's public endpoint can be disabled entirely. Exam answer for "no public internet" = Private Endpoint.

Network Security Groups (NSGs)

Filter traffic at the subnet or NIC level.

Essential Rules for Database Subnets

PriorityDirectionSourceDest PortActionPurpose
100InboundApp Subnet1433✅ AllowSQL from app tier
200InboundMgmt Subnet3389/22✅ AllowAdmin RDP/SSH
300InboundAny1433❌ DenyBlock all other SQL
65000InboundVNetAny✅ AllowDefault VNet rule
65500InboundAnyAny❌ DenyDefault deny-all
⚠️ Watch Out

NSG rules are evaluated by priority number (lowest = first). The first matching rule wins. Default rules (65000+) allow VNet-to-VNet and deny everything else. You CANNOT delete default rules, but you can override them with lower-priority rules.

DNS Resolution with Private Endpoints

Private Endpoints require DNS configuration so that server.database.windows.net resolves to the private IP instead of the public IP.

DNS Resolution with Private Endpoints
📱
App Queries DNS
App connects to server.database.windows.net
DNS lookup initiated
🌐
Private DNS Zone
Azure Private DNS Zone resolves FQDN
Returns private IP (e.g., 10.0.1.5) instead of public IP
🔒
Private Connection
Traffic flows to Private Endpoint NIC
Over Azure backbone — never touches public internet
🏢 Real-World DBA Note

When you create a Private Endpoint in the portal, Azure offers to create a Private DNS Zone automatically. Always accept this — it configures DNS so VNet-integrated apps automatically resolve to the private IP. On-premises clients need conditional DNS forwarding to the Azure Private DNS zone.

Managed Instance Networking

MI has unique networking requirements:

RequirementDetail
Dedicated subnetNo other resources allowed
Minimum size/27 (32 IPs), recommend /26
DelegationMicrosoft.Sql/managedInstances
NSGAuto-created, you can add rules
Route TableAuto-created with mandatory management routes
Managed Instance Networking
🌐
Dedicated Subnet
MI requires its own subnet (/27 min, /26 recommended). Delegated to Microsoft.Sql/managedInstances. No other resources.
🛡️
NSG + Route Table
Auto-created and managed by Azure. Mandatory management routes. You can add additional custom rules.
🔗
Gateway Endpoint
MI accessible via public endpoint (optional) or VNet-internal private endpoint. Gateway handles connection routing.
⚠️ Watch Out

Never delete or modify the auto-managed routes in the MI route table. These are required for Azure to manage the MI instance (patching, HA, backups). You CAN add additional routes (e.g., for on-premises connectivity via VPN gateway).

ExpressRoute vs VPN Gateway

For connecting on-premises Oracle databases to Azure during migration:

VPN GatewayExpressRoute
ConnectionOver public internet (encrypted)Private dedicated circuit
BandwidthUp to ~1.25 GbpsUp to 100 Gbps
LatencyVariablePredictable, low
CostLowerHigher
SetupHoursDays/weeks (requires telco)
Use caseDev/test, small migrationsProduction, large data transfers

Private Endpoint vs Service Endpoint — key difference?
Click to reveal answer
Private Endpoint = private IP in your VNet (public endpoint can be disabled). Service Endpoint = traffic goes via Azure backbone but public IP still exists.
1 / 5