Question

A financial services company runs an internal line-of-business application on Azure App Service (integrated into a spoke VNet). The application must connect to an Azure SQL Database and an Azure Storage account. Compliance requires that all traffic to these PaaS services stay on the Microsoft backbone and that the services have NO public endpoint reachable from the internet. On-premises users reach the app over ExpressRoute through a hub VNet. Which design meets these requirements with the least ongoing management overhead?

Accepted Answer

Create private endpoints for the SQL Database and Storage account, disable public network access on both, and use Azure Private DNS zones linked to the hub and spoke VNets.

Answer

Enable service endpoints for Azure SQL and Storage on the spoke subnet, and restrict the PaaS firewalls to that subnet's traffic.

Answer

Place the SQL Database and Storage account behind an Azure Application Gateway with a private frontend IP and configure NSG rules to block internet traffic.

Answer

Use IP-based firewall rules on the SQL Database and Storage account to allow only the ExpressRoute public peering address ranges.