{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/", "slug": "dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg", "url": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/" }, "title": "Preserve probes and application paths in a private Application Gateway NSG", "summary": "Enhanced network controls remove certain management allowances, not the need for health probes, authorized clients or backend connectivity.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:46+00:00", "modified_at": "2026-09-10T01:40:02+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Application Gateway v2 private deployments registered for enhanced network controls.", "dse_recommendation": "Review health-probe, client and backend paths separately before applying restrictive subnet rules.", "primary_source": { "name": "Private Application Gateway deployment - Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For registered private Application Gateway v2 deployments, Microsoft removes the requirement for inbound GatewayManager and outbound Internet allowances. Inbound AzureLoadBalancer traffic is still required for health probes.

\n

The documentation’s restrictive NSG example separately permits client traffic and outbound backend traffic. Microsoft warns that deny-all rules can block intended clients or backends; blocking the backend path can cause failed health and 5XX responses. Private deployments also require subnet delegation to Microsoft.Network/applicationGateways. Microsoft Learn.

\n

Applicability

\n

Confirm feature registration, deployment context and subnet delegation. A pre-feature gateway sharing the subnet prevents use of the enhanced controls until earlier gateways are reprovisioned or new gateways use another subnet. Include coexisting gateways in the review, not just the one being edited.

\n

DSE recommendation

\n

DSE recommends a three-part rule review: platform probes, approved client-to-listener access and gateway-to-backend access. Identify each required path from the actual design before adding deny-all rules. Keep documented example addresses out of production configuration. Have the application and network owners agree which tests will distinguish a rejected client from an unreachable backend.

\n

Verification

\n

In an approved test, inspect probe health and exercise both permitted and excluded client requests. Verify the intended backend is reached and that its health remains acceptable after the NSG change. Preserve the effective rules and observations together. If 5XX responses appear, investigate the backend path as well as the listener before declaring the private gateway itself unavailable.

\n

Official references

\n

Microsoft Learn: Private Application Gateway deployment. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor registered private Application Gateway v2 deployments, Microsoft removes the requirement for inbound GatewayManager and outbound Internet allowances. Inbound AzureLoadBalancer traffic is still required for health probes.\nThe documentation’s restrictive NSG example separately permits client traffic and outbound backend traffic. Microsoft warns that deny-all rules can block intended clients or backends; blocking the backend path can cause failed health and 5XX responses. Private deployments also require subnet delegation to Microsoft.Network/applicationGateways. Microsoft Learn.\nApplicability\nConfirm feature registration, deployment context and subnet delegation. A pre-feature gateway sharing the subnet prevents use of the enhanced controls until earlier gateways are reprovisioned or new gateways use another subnet. Include coexisting gateways in the review, not just the one being edited.\nDSE recommendation\nDSE recommends a three-part rule review: platform probes, approved client-to-listener access and gateway-to-backend access. Identify each required path from the actual design before adding deny-all rules. Keep documented example addresses out of production configuration. Have the application and network owners agree which tests will distinguish a rejected client from an unreachable backend.\nVerification\nIn an approved test, inspect probe health and exercise both permitted and excluded client requests. Verify the intended backend is reached and that its health remains acceptable after the NSG change. Preserve the effective rules and observations together. If 5XX responses appear, investigate the backend path as well as the listener before declaring the private gateway itself unavailable.\nOfficial references\nMicrosoft Learn: Private Application Gateway deployment. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor registered private Application Gateway v2 deployments, Microsoft removes the requirement for inbound GatewayManager and outbound Internet allowances. Inbound AzureLoadBalancer traffic is still required for health probes.\n\nThe documentation’s restrictive NSG example separately permits client traffic and outbound backend traffic. Microsoft warns that deny-all rules can block intended clients or backends; blocking the backend path can cause failed health and 5XX responses. Private deployments also require subnet delegation to Microsoft.Network/applicationGateways. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment).\n\n## Applicability\n\nConfirm feature registration, deployment context and subnet delegation. A pre-feature gateway sharing the subnet prevents use of the enhanced controls until earlier gateways are reprovisioned or new gateways use another subnet. Include coexisting gateways in the review, not just the one being edited.\n\n## DSE recommendation\n\nDSE recommends a three-part rule review: platform probes, approved client-to-listener access and gateway-to-backend access. Identify each required path from the actual design before adding deny-all rules. Keep documented example addresses out of production configuration. Have the application and network owners agree which tests will distinguish a rejected client from an unreachable backend.\n\n## Verification\n\nIn an approved test, inspect probe health and exercise both permitted and excluded client requests. Verify the intended backend is reached and that its health remains acceptable after the NSG change. Preserve the effective rules and observations together. If 5XX responses appear, investigate the backend path as well as the listener before declaring the private gateway itself unavailable.\n\n## Official references\n\n[Microsoft Learn: Private Application Gateway deployment](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/", "url": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve probes and application paths in a private Application Gateway NSG", "item": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/", "url": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/", "headline": "Preserve probes and application paths in a private Application Gateway NSG", "description": "Enhanced network controls remove certain management allowances, not the need for health probes, authorized clients or backend connectivity.", "abstract": "Enhanced network controls remove certain management allowances, not the need for health probes, authorized clients or backend connectivity.", "articleBody": "Source facts\nFor registered private Application Gateway v2 deployments, Microsoft removes the requirement for inbound GatewayManager and outbound Internet allowances. Inbound AzureLoadBalancer traffic is still required for health probes.\nThe documentation’s restrictive NSG example separately permits client traffic and outbound backend traffic. Microsoft warns that deny-all rules can block intended clients or backends; blocking the backend path can cause failed health and 5XX responses. Private deployments also require subnet delegation to Microsoft.Network/applicationGateways. Microsoft Learn.\nApplicability\nConfirm feature registration, deployment context and subnet delegation. A pre-feature gateway sharing the subnet prevents use of the enhanced controls until earlier gateways are reprovisioned or new gateways use another subnet. Include coexisting gateways in the review, not just the one being edited.\nDSE recommendation\nDSE recommends a three-part rule review: platform probes, approved client-to-listener access and gateway-to-backend access. Identify each required path from the actual design before adding deny-all rules. Keep documented example addresses out of production configuration. Have the application and network owners agree which tests will distinguish a rejected client from an unreachable backend.\nVerification\nIn an approved test, inspect probe health and exercise both permitted and excluded client requests. Verify the intended backend is reached and that its health remains acceptable after the NSG change. Preserve the effective rules and observations together. If 5XX responses appear, investigate the backend path as well as the listener before declaring the private gateway itself unavailable.\nOfficial references\nMicrosoft Learn: Private Application Gateway deployment. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:46+00:00", "dateModified": "2026-09-10T01:40:02+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve probes and application paths in a private Application Gateway NSG" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Private Application Gateway deployment - Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment" } } ] } }