Azure Network Security Perimeter draws a logical network boundary around PaaS resources that run outside your virtual networks.
What is Azure Network Security Perimeter?
Azure Network Security Perimeter creates logical network boundaries around platform-as-a-service (PaaS) resources that are deployed outside your virtual networks. It lets you control public network access to resources such as Azure Storage accounts and Azure Key Vault by establishing a secure perimeter.
By default, a network security perimeter restricts public access to the PaaS resources within the boundary. You grant exceptions through explicit access rules for inbound and outbound traffic. This approach helps prevent data exfiltration while maintaining the connectivity your applications need.
How it relates to Private Link: for access patterns involving traffic from virtual networks to PaaS resources, Microsoft points to Azure Private Link. Network security perimeter instead addresses communication for PaaS services deployed outside the virtual network.
Core Features
- Intra-perimeter communication: resource-to-resource access between perimeter members, preventing data exfiltration to non-authorized destinations
- External public access management: explicit rules for PaaS resources associated with the perimeter
- Access logs: logging for audit and compliance
- Unified experience: a consistent approach across PaaS resources
- Profiles: group PaaS resources with similar inbound and outbound access requirements
- Private endpoints: private endpoint traffic is allowed without explicit access rules
Typical Use Cases
Preventing data exfiltration
The purpose Microsoft names first: PaaS resources are associated with the perimeter, blocking outflows to non-authorized destinations.
Central rule management
Instead of maintaining firewall settings per service, access rules for all PaaS resources in the perimeter are managed in one place.
Controlled external access
Public inbound access is approved using network and identity attributes of the client, such as source IP addresses or subscriptions; outbound access uses FQDNs of the external destinations.
Phased adoption
Transition mode lets you observe existing access patterns before switching to enforced mode.
Audit evidence
Diagnostics settings produce access logs for the PaaS resources within the perimeter.
Benefits
- Protection for PaaS services that inherently sit outside the virtual network
- Deny-by-default in enforced mode instead of selective one-off exceptions
- One operating model across different PaaS services
- A low-risk entry point through transition mode
- Works alongside private endpoints without additional rules
Integration with innFactory
As an indirect Microsoft CSP partner, innFactory supports the design and rollout of network security perimeters: structuring perimeters and profiles, defining access rules, evaluating the observations from transition mode, and accounting for the documented limitations, for example the interaction with Microsoft Sentinel or Azure Backup.
We describe how this fits into an overarching network and governance architecture in our article on Azure Landing Zones.
Contact us for a no-obligation consultation on securing PaaS resources on Microsoft Azure.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
Is network security perimeter generally available?
Microsoft states: "Network security perimeter is now generally available in all Azure public cloud regions and in Azure Government regions (US Gov Virginia, US Gov Texas, US Gov Arizona, US DoD East and US DoD Central)." Individual onboarded services remain in public preview, specifically Cosmos DB, SQL DB, and Azure OpenAI Service.
What happens once the perimeter is enabled?
When a network security perimeter is created and PaaS resources are associated with it in enforced mode, all public traffic is denied by default, preventing data exfiltration outside the perimeter. You grant exceptions through explicit access rules for inbound and outbound traffic.
Which access modes exist?
Two. Transition mode, formerly learning mode, is the default access mode and helps network administrators understand the existing access patterns of their PaaS resources; Microsoft advises using it before transitioning to enforced mode. In enforced mode, all traffic except intra-perimeter traffic is denied by default unless an allow rule exists.
Which rule types are supported?
Inbound subscription-based rules and IP-based rules, and outbound FQDN-based rules. With standard service endpoints, the perimeter can additionally authorize inbound traffic using network identifiers - public IP addresses or prefixes associated with service endpoint subnets.
Which services can be associated with a perimeter?
Per Microsoft, Azure Monitor, Azure AI Search, Event Hubs, Key Vault, Storage, Microsoft Foundry, and Azure Service Bus are generally available. Cosmos DB, SQL DB, and Azure OpenAI Service are in public preview.
Which limitations should I be aware of?
Microsoft names, among others: network security perimeters are not supported for Log Analytics workspaces enabled for Microsoft Sentinel, Azure Backup is not supported for storage accounts enabled with a network security perimeter, service endpoint traffic is not supported, and resource names cannot be longer than 44 characters. Scale limits also apply, such as up to 200 rule elements per profile for inbound and outbound each.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
