Network Security in an Azure App Service Environment
Ayush Dhungel
Ottawa University
NETWORK-ESSENTIALS-IT-7003
Dr. Cyndi (CK) Lambach
December 13, 2025
Overview of the Selected Network Diagram
For this project, I selected a network architecture diagram from Microsoft Learn’s Azure Architecture Center that demonstrates how Azure App Service integrates into a secure virtual network (Microsoft, 2025a). The diagram presents a complete cloud environment beginning with user traffic from the public internet, which first encounters a Distributed Denial of Service (DDoS) protection layer. This layer mitigates volumetric attacks designed to overwhelm availability. Traffic then proceeds to an Azure Application Gateway equipped with a Web Application Firewall (WAF), which is hosted inside its own Application Gateway Subnet within the Azure Virtual Network. The WAF inspects, filters, and blocks malicious requests before they reach downstream resources.
Within the virtual network, the architecture contains several specialized subnets. The App Service Integration Subnet supports Virtual Network (VNet) integration, enabling Azure App Service to access internal resources securely using private IP addresses. The Private Endpoint Subnet hosts private interfaces for Azure Structure Query Language (SQL) Database, Azure Key Vault, Azure Storage, and App Service. Private endpoints ensure these services are accessible only through internal network routes rather than public Uniform Resource Locaters (URLs). The Agents Subnet houses self-hosted virtual machines (VMs) used by the Azure DevOps release pipeline, ensuring that deployments occur inside a protected environment. Domain Name System (DNS) resolution is performed through Private DNS Zones linked to the virtual network, allowing services to resolve Fully Qualified Domain Names (FQDNs) privately without relying on public DNS servers (Microsoft, 2025a).
Azure App Service is deployed across three availability zones, which improves reliability and resiliency. Identity and access management are handled by Azure Active Directory (Azure AD), which supports centralized authentication and authorization. Monitoring is performed using Azure Monitor and Application Insights, both of which collect telemetry across application and infrastructure layers. Together, these components form a cohesive cloud architecture that balances scalability, security, and administrative control (Microsoft, 2025a).
Figure 1
Azure App Service Architecture Diagram
Note. Adapted from “Azure Icons – Azure Architecture Center,” by Microsoft, 2025, Microsoft Learn (https://learn.microsoft.com/en-us/azure/architecture/icons/)
Rationale for Selecting This Diagram
I selected this diagram because it closely reflects the environment in which I work every day. As a software developer responsible for building internal business applications, automation workflows, and dealership operational systems, I frequently work with Azure App Service, Azure Functions, Azure SQL Database, Azure Storage, and Azure Key Vault. Although I have long understood how to write code and deploy cloud applications, early in my career I did not fully appreciate the role of networking, DNS behavior, private endpoints, and identity governance in securing the systems I was developing.
This diagram bridges that gap by providing a visual representation of how user traffic, identity, DNS, deployment pipelines, and private networking converge within Azure. Understanding this network flow clarifies how an application request moves through DDoS protection, WAF filtering, subnet boundaries, DNS resolution, and private service endpoints before reaching its final destination. This knowledge directly influences how I design secure APIs, manage application secrets, and architect reliable deployments. It also strengthens my ability to collaborate with network security and IT teams because I can now anticipate constraints, align my software with enterprise policies, and contribute meaningful recommendations during design and security reviews.
The diagram is also well-suited for a graduate-level project because it integrates several of the concepts studied in this course, including routing, segmentation, identity management, DNS, application-layer protections, virtualized infrastructure, and DevOps pipelines. These elements create multiple potential attack vectors and opportunities for remediation, making the architecture ideal for in-depth analysis.
Ten Security-Related Issues and Remediation Strategies
Based on the research conducted for this project and the material covered throughout this course, ten security issues were identified as directly relevant to the selected Azure App Service architecture. The first issue concerns subnet isolation and the absence of clearly defined Network Security Groups (NSGs). Without precise traffic filtering rules at the subnet level, resources can communicate more freely than intended, which creates opportunities for lateral movement inside the virtual network (Microsoft, 2025a). Implementing NSGs with deny-all defaults and specific allow rules, supported by Azure Policy enforcement, significantly improves segmentation and conforms to Zero Trust principles (NIST, 2020).
The second issue involves the attack surface introduced by self-hosted Azure DevOps agents residing in the Agents Subnet. These agents participate in the Continuous Integration and Continuous Delivery (CI/CD) pipeline and therefore have privileged access to application deployment artifacts. If an attacker compromises an agent, they can modify deployments or introduce malicious code into the environment. Restricting outbound connectivity, using Managed Identities instead of stored secrets, implementing Just-In-Time access, and enabling Microsoft Defender for DevOps are effective strategies to mitigate this risk (Microsoft, 2025a).
A third issue emerges from the reliance on private endpoints and Private DNS Zones. Private endpoints require precise DNS configuration, and improper linking of DNS zones could cause services to resolve to public IP addresses rather than private ones. This creates exposure risks and can result in traffic leaving the protected network. The environment should disable all public network access for private endpoint–enabled services, enforce proper DNS zone linking using Azure Policy, and activate DNS query logging to detect anomalies in name resolution (Microsoft, 2025a).
A fourth issue is associated with the configuration of the Application Gateway and Web Application Firewall (WAF). If the WAF operates only in Detection mode or allows outdated Transport Layer Security (TLS) versions, the application becomes vulnerable to threats such as Structured Query Language (SQL) injection, cross-site scripting, or automated bot attacks. Enabling WAF Prevention mode, enforcing TLS 1.2 or higher, applying geo-filtering and bot protection, and routing all logs into Application Insights strengthen this critical entry point (Microsoft, 2025a).
The fifth issue involves identity governance in Azure Active Directory (Azure AD). Although Azure AD is present in the diagram, the architecture does not specify whether Multi-Factor Authentication (MFA), Conditional Access policies, or Privileged Identity Management (PIM) are enabled. Weak identity controls are a leading cause of cloud breaches, particularly when developers or DevOps accounts possess persistent elevated privileges (Amazon Web Services, 2023). Enforcing MFA, enabling Conditional Access based on device compliance and sign-in risk, and using PIM to limit the duration of administrative roles to provide a strong identity security foundation.
The sixth issue is incomplete logging and monitoring across the environment. While Azure Monitor and Application Insights are shown, the diagram does not confirm whether diagnostic logs are enabled for the Application Gateway, WAF, private endpoints, SQL Database, Key Vault, or Storage Accounts. Without full visibility, security events may go undetected. Configuring diagnostic logs for all services, forwarding them to a centralized Log Analytics Workspace, and establishing actionable alerts enhances situational awareness and incident response (Microsoft, 2025a).
A seventh issue relates to backup and disaster recovery. The diagram does not indicate whether backups are configured for SQL Database, Storage Accounts, or App Service configuration settings. Without clear recovery mechanisms, human error, corruption, or outages could result in data loss. SQL automated backups with long-term retention, Storage Account soft delete and immutable blob storage, and export of App Service settings ensure that the environment can recover quickly from failures.
An eighth issue arises from the absence of an outbound firewall layer. Although the Application Gateway protects inbound traffic, there is no mechanism shown for inspecting or controlling outbound traffic leaving the virtual network. Without egress filtering, compromised workloads may connect to external command-and-control servers. Deploying Azure Firewall, configuring forced tunneling, and restricting outbound traffic to approved service tags limit this risk substantially (Microsoft, 2025a).
The ninth issue involves secret rotation and Managed Identity enforcement. The presence of Key Vault does not confirm whether keys, certificates, or application secrets rotate regularly or whether applications use hard-coded secrets. Automatically rotating secrets, using system-assigned or user-assigned Managed Identities, and removing credentials from configuration files are critical steps in reducing the risk of credential theft (Amazon Web Services, 2023).
The tenth issue concerns tenant restrictions and device compliance controls in Azure AD. Without Conditional Access policies enforcing device compliance or restricting which tenants users can authenticate against, accounts could be accessed from unmanaged devices or external tenants. Implementing strict Conditional Access requirements ensures that only trusted devices and approved tenants participate in authentication, significantly strengthening the environment’s identity security posture (NIST, 2020).
Top Two Critical Issues
The most critical issue is the lack of subnet isolation, because unrestricted communication inside a virtual network undermines all other layers of security (Microsoft, 2025a). Without segmentation, an attacker who compromises a single component could move laterally to sensitive resources such as Azure SQL Database or Azure Key Vault. The second most critical issue is the DevOps pipeline attack surface, because a compromised self-hosted agent provides an attacker with the ability to deploy malicious code directly into production. Addressing these two issues first provides the strongest foundation for securing the remaining environment (Microsoft, 2025a).
Conclusion
This analysis demonstrates that securing an Azure App Service environment requires careful coordination across networking, identity, DNS, and DevOps controls. By examining the architecture through a Zero Trust perspective, it becomes clear that subnet segmentation and pipeline security form the foundation for protecting the broader environment. As a software developer who regularly builds and deploys cloud-based systems, understanding these network behaviors enhances my ability to design secure, resilient applications. Addressing the identified risks strengthens both operational reliability and the organization’s overall security posture. These improvements ultimately ensure that cloud workloads remain protected against modern threats while enabling scalable and efficient application delivery.
References
Amazon Web Services. (2023). Implementing Zero Trust principles in cloud-native applications. AWS Whitepaper Series. https://docs.aws.amazon.com/whitepapers/
Microsoft. (2025a). Azure best practices for network security. Microsoft Learn. https://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
Microsoft. (2025b). Azure icons – Azure Architecture Center. Microsoft Learn. https://learn.microsoft.com/en-us/azure/architecture/icons/
National Institute of Standards and Technology. (2020). Zero Trust Architecture (NIST Special Publication 800-207). U.S. Department of Commerce. https://doi.org/10.6028/NIST.SP.800-207