Prove that an Azure SQL private-endpoint connection traverses the intended firewall

Source facts

Microsoft’s private-endpoint inspection tutorial connects the client and private-endpoint virtual networks through a firewall network, without direct peering between those two endpoint networks. It configures an Azure Firewall application rule for the SQL server name, tests a SQL connection, and then examines firewall logs. The tutorial requires a Log Analytics workspace before enabling those logs. Microsoft Learn.

Applicability

Consider this review for the tutorial’s Azure SQL inspection pattern. Identify the client, SQL name, endpoint, route table and intended firewall. Compare the complete current tutorial with the proposed topology; the example does not certify arbitrary private-endpoint deployments.

DSE recommendation

DSE recommends requiring path evidence as part of the acceptance record. Have the network owner document the intended peerings and routes, while the application owner supplies a harmless SQL test. Prepare the logging destination and observation window before the test so a successful connection can be investigated while its evidence is available.

Verification

Record name resolution, the effective client route and the test timestamp. Correlate the successful SQL transaction with the expected firewall log entry and rule. Investigate missing or contradictory observations before claiming inspection. Retain sanitized identifiers and results without including database credentials or production query contents.

Official references

Microsoft Learn: Tutorial: Inspect private endpoint traffic with Azure Firewall.