# Preserve probes and application paths in a private Application Gateway NSG

> Enhanced network controls remove certain management allowances, not the need for health probes, authorized clients or backend connectivity.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:46+00:00
- Modified: 2026-09-10T01:40:02+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Enhanced network controls remove certain management allowances, not the need for health probes, authorized clients or backend connectivity.

## Potentially affected

Application Gateway v2 private deployments registered for enhanced network controls.

## DSE recommendation

Review health-probe, client and backend paths separately before applying restrictive subnet rules.

## Article

## Source facts

For registered private Application Gateway v2 deployments, Microsoft removes the requirement for inbound GatewayManager and outbound Internet allowances. Inbound AzureLoadBalancer traffic is still required for health probes.

The documentation’s restrictive NSG example separately permits client traffic and outbound backend traffic. Microsoft warns that deny-all rules can block intended clients or backends; blocking the backend path can cause failed health and 5XX responses. Private deployments also require subnet delegation to Microsoft.Network/applicationGateways. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment).

## Applicability

Confirm feature registration, deployment context and subnet delegation. A pre-feature gateway sharing the subnet prevents use of the enhanced controls until earlier gateways are reprovisioned or new gateways use another subnet. Include coexisting gateways in the review, not just the one being edited.

## DSE recommendation

DSE recommends a three-part rule review: platform probes, approved client-to-listener access and gateway-to-backend access. Identify each required path from the actual design before adding deny-all rules. Keep documented example addresses out of production configuration. Have the application and network owners agree which tests will distinguish a rejected client from an unreachable backend.

## Verification

In an approved test, inspect probe health and exercise both permitted and excluded client requests. Verify the intended backend is reached and that its health remains acceptable after the NSG change. Preserve the effective rules and observations together. If 5XX responses appear, investigate the backend path as well as the listener before declaring the private gateway itself unavailable.

## Official references

[Microsoft Learn: Private Application Gateway deployment](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment). Source retrieved September 9, 2026.

## Primary reference

- Name: Private Application Gateway deployment - Azure Application Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Preserve probes and application paths in a private Application Gateway NSG,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-310-preserve-probes-and-application-paths-in-a-private-application-gateway-nsg/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.