Question

Your company operates a multi-tenant SaaS platform behind a Standard internal Load Balancer. You expose it to customers through an Azure Private Link service. The application team reports that all incoming requests appear to originate from the Private Link service NAT IP addresses, but they need to capture the true source IP of each consumer connection for per-tenant auditing. What should you do on the Private Link service to make the original consumer source information available to the backend application?

Accepted Answer

Enable the TCP Proxy Protocol v2 setting on the Private Link service and update the backend application to parse the PROXY protocol header.

Answer

Add a service endpoint policy on the load balancer's subnet to preserve the consumer source IP.

Answer

Disable NAT on the Private Link service NAT IP configuration so the consumer IP passes through unchanged.

Answer

Configure the internal Load Balancer with Direct Server Return (Floating IP) to retain the client source IP.