# Prove that an Azure SQL private-endpoint connection traverses the intended firewall

> Pair a successful SQL connection with evidence of the firewall path.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:43+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Pair a successful SQL connection with evidence of the firewall path.

## Potentially affected

Consider this review for the tutorial's Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.

## DSE recommendation

DSE recommends requiring path evidence as part of the acceptance record.

## Article

## Source facts

Microsoft’s private-endpoint inspection tutorial connects the client and private-endpoint virtual networks through a firewall network, without direct peering between those two endpoint networks. It configures an Azure Firewall application rule for the SQL server name, tests a SQL connection, and then examines firewall logs. The tutorial requires a Log Analytics workspace before enabling those logs. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall).

## Applicability

Consider this review for the tutorial’s Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.

## DSE recommendation

DSE recommends requiring path evidence as part of the acceptance record. Have the network owner document the intended peerings and routes, while the application owner supplies a harmless SQL test. Prepare the logging destination and observation window before the test so a successful connection can be investigated while its evidence is available.

## Verification

Record name resolution, the effective client route and the test timestamp. Correlate the successful SQL transaction with the expected firewall log entry and rule. Investigate missing or contradictory observations before claiming inspection. Retain sanitized identifiers and results without including database credentials or production query contents.

## Official references

[Microsoft Learn: Tutorial: Inspect private endpoint traffic with Azure Firewall](https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall).

## Primary reference

- Name: Tutorial: Inspect private endpoint traffic with Azure Firewall | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Prove that an Azure SQL private-endpoint connection traverses the intended firewall,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-017-prove-that-an-azure-sql-private-endpoint-connection-traverses-the-intended-firewall/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.