{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/", "slug": "dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall", "url": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/" }, "title": "Prove that an Azure SQL private-endpoint connection traverses the intended firewall", "summary": "Pair a successful SQL connection with evidence of the firewall path.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:43+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Consider this review for the tutorial's Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.", "dse_recommendation": "DSE recommends requiring path evidence as part of the acceptance record.", "primary_source": { "name": "Tutorial: Inspect private endpoint traffic with Azure Firewall | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s private-endpoint inspection tutorial connects the client and private-endpoint virtual networks through a firewall network, without direct peering between those two endpoint networks. It configures an Azure Firewall application rule for the SQL server name, tests a SQL connection, and then examines firewall logs. The tutorial requires a Log Analytics workspace before enabling those logs. Microsoft Learn.

\n

Applicability

\n

Consider this review for the tutorial’s Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.

\n

DSE recommendation

\n

DSE recommends requiring path evidence as part of the acceptance record. Have the network owner document the intended peerings and routes, while the application owner supplies a harmless SQL test. Prepare the logging destination and observation window before the test so a successful connection can be investigated while its evidence is available.

\n

Verification

\n

Record name resolution, the effective client route and the test timestamp. Correlate the successful SQL transaction with the expected firewall log entry and rule. Investigate missing or contradictory observations before claiming inspection. Retain sanitized identifiers and results without including database credentials or production query contents.

\n

Official references

\n

Microsoft Learn: Tutorial: Inspect private endpoint traffic with Azure Firewall.

", "content_text": "Source facts\nMicrosoft’s private-endpoint inspection tutorial connects the client and private-endpoint virtual networks through a firewall network, without direct peering between those two endpoint networks. It configures an Azure Firewall application rule for the SQL server name, tests a SQL connection, and then examines firewall logs. The tutorial requires a Log Analytics workspace before enabling those logs. Microsoft Learn.\nApplicability\nConsider this review for the tutorial’s Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.\nDSE recommendation\nDSE recommends requiring path evidence as part of the acceptance record. Have the network owner document the intended peerings and routes, while the application owner supplies a harmless SQL test. Prepare the logging destination and observation window before the test so a successful connection can be investigated while its evidence is available.\nVerification\nRecord name resolution, the effective client route and the test timestamp. Correlate the successful SQL transaction with the expected firewall log entry and rule. Investigate missing or contradictory observations before claiming inspection. Retain sanitized identifiers and results without including database credentials or production query contents.\nOfficial references\nMicrosoft Learn: Tutorial: Inspect private endpoint traffic with Azure Firewall.", "content_markdown": "## Source facts\n\nMicrosoft’s private-endpoint inspection tutorial connects the client and private-endpoint virtual networks through a firewall network, without direct peering between those two endpoint networks. It configures an Azure Firewall application rule for the SQL server name, tests a SQL connection, and then examines firewall logs. The tutorial requires a Log Analytics workspace before enabling those logs. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall).\n\n## Applicability\n\nConsider this review for the tutorial’s Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.\n\n## DSE recommendation\n\nDSE recommends requiring path evidence as part of the acceptance record. Have the network owner document the intended peerings and routes, while the application owner supplies a harmless SQL test. Prepare the logging destination and observation window before the test so a successful connection can be investigated while its evidence is available.\n\n## Verification\n\nRecord name resolution, the effective client route and the test timestamp. Correlate the successful SQL transaction with the expected firewall log entry and rule. Investigate missing or contradictory observations before claiming inspection. Retain sanitized identifiers and results without including database credentials or production query contents.\n\n## Official references\n\n[Microsoft Learn: Tutorial: Inspect private endpoint traffic with Azure Firewall](https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/", "url": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Prove that an Azure SQL private-endpoint connection traverses the intended firewall", "item": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/", "url": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/", "headline": "Prove that an Azure SQL private-endpoint connection traverses the intended firewall", "description": "Pair a successful SQL connection with evidence of the firewall path.", "abstract": "Pair a successful SQL connection with evidence of the firewall path.", "articleBody": "Source facts\nMicrosoft’s private-endpoint inspection tutorial connects the client and private-endpoint virtual networks through a firewall network, without direct peering between those two endpoint networks. It configures an Azure Firewall application rule for the SQL server name, tests a SQL connection, and then examines firewall logs. The tutorial requires a Log Analytics workspace before enabling those logs. Microsoft Learn.\nApplicability\nConsider this review for the tutorial’s Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.\nDSE recommendation\nDSE recommends requiring path evidence as part of the acceptance record. Have the network owner document the intended peerings and routes, while the application owner supplies a harmless SQL test. Prepare the logging destination and observation window before the test so a successful connection can be investigated while its evidence is available.\nVerification\nRecord name resolution, the effective client route and the test timestamp. Correlate the successful SQL transaction with the expected firewall log entry and rule. Investigate missing or contradictory observations before claiming inspection. Retain sanitized identifiers and results without including database credentials or production query contents.\nOfficial references\nMicrosoft Learn: Tutorial: Inspect private endpoint traffic with Azure Firewall.", "datePublished": "2026-09-17T16:34:43+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Prove that an Azure SQL private-endpoint connection traverses the intended firewall" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Tutorial: Inspect private endpoint traffic with Azure Firewall | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall" } } ] } }