Azure Virtual Network Manager applies connectivity and security configurations to selected network groups. This mechanism is associated with a different case: A Virtual Network Manager configuration targets the wrong network group and unexpectedly includes a sensitive production subnet.

Azure Network Watcher next hop and effective routes help diagnose Azure-managed routing decisions. This mechanism is associated with a different case: A route through a network virtual appliance appears correct but a VM cannot reach a private workload in another subnet.

App Service VNet integration enables outbound network access while Private Endpoint enables private inbound access to the web app. This mechanism is associated with a different case: An App Service web app must privately reach a database in a VNet but an engineer creates a Private Endpoint for the web app instead.

Privileged access governance includes periodic entitlement review in addition to just-in-time role activation. This mechanism is associated with a different case: A security review finds several eligible PIM assignments with no documented owner, end date or periodic reassessment.

Azure RBAC authorization should match both operation and resource scope, with time constraints when appropriate. This mechanism is associated with a different case: A security analyst grants an external consultant permanent access to all resource groups to troubleshoot one VM.

Managed identities provide Microsoft Entra-backed tokens for supported Azure workloads without developer-managed credentials. This mechanism is associated with a different case: An Azure Function needs to read a Key Vault secret but developers propose embedding a long-lived client secret in application settings.

Azure immutable blob storage can enforce write-once-read-many retention policies beyond standard user permissions. This mechanism is associated with a different case: A regulated archive requires that retained records cannot be changed before their approved retention period ends.

Container image supply-chain controls require identity-scoped push access and verifiable artifact selection. This mechanism is associated with a different case: A build pipeline pushes unapproved image tags into a production Container Registry because all jobs share a registry push token.

Azure Storage separates management-plane Azure RBAC roles from blob data-plane authorization roles. This mechanism is associated with a different case: A user has the Azure Reader management-plane role on a storage account and assumes it can download all blob contents.

A missing vulnerability report can reflect missing scan coverage rather than absence of exploitable software. This hazard concerns another scenario: A critical Azure VM has no vulnerability findings, and an operator assumes it has no vulnerable packages despite disabled assessment settings.

Acknowledging or commenting on a security recommendation does not inherently remove the underlying exposure. This hazard concerns another scenario: A Defender recommendation identifies a resource with public network access, but the team closes the finding by adding a comment.

Key Vault RBAC permissions do not themselves constrain every possible network origin for a secret request. This hazard concerns another scenario: An Azure Key Vault is placed behind a firewall but its application still accesses a public endpoint without an approved network rule.

Review Azure Firewall SKU and feature support, then enable appropriate Premium TLS inspection or IDPS controls where supported. This is a valid action in another context: A security operations team sees threat indicators indicating malicious TLS traffic through Azure Firewall and assumes all tiers inspect encrypted payloads equally.

Evaluate the applicable Azure DDoS Protection coverage and service configuration alongside HTTP-level WAF controls. This is a valid action in another context: A regional web application is overwhelmed by volumetric traffic and an engineer assumes WAF request rules alone prevent all network-layer attacks.

Verify inbound access restrictions, public network access settings and the private endpoint DNS configuration. This is a valid action in another context: An App Service private endpoint is deployed for an internal site, but users from the public internet still reach its ordinary public hostname.

Assign the least-privileged appropriate Azure RBAC reader role at the required management-group scope. This is a valid action in another context: A central team needs read-only security posture visibility across a management group without modifying any descendant subscriptions.

Validate delegated scopes and application role claims separately and enforce the API's intended permission model. This is a valid action in another context: A custom API supports both user-level delegated access and daemon application calls, but its authorization code checks only the scope claim.

Register exact approved redirect URIs for the application platform and remove unnecessary callback locations. This is a valid action in another context: A developer configures redirect URIs for a production application using a broad wildcard and an untrusted host.

Configure a supported Azure Front Door endpoint and WAF policy with secured origin access. This is a valid action in another context: A globally distributed website suffers high latency and needs edge-based TLS, intelligent routing and an HTTP WAF.

Design explicit supported hub routing, gateway or virtual appliance transit rather than relying on transitive peering. This is a valid action in another context: Two peered virtual networks can reach each other, but the architect assumes peering is automatically transitive across a third network.

Create the intended Private Endpoint DNS zone links and ensure the resource FQDN resolves to the endpoint private address. This is a valid action in another context: An Azure Storage account allows only private access but its application still resolves the blob hostname to the public service endpoint.

The application reads the intended view but cannot alter schema, change permissions or inspect restricted tables. That would be evidence for the separate situation: The security team discovers that an application login has db_owner even though the job reads one reporting view.

The test user can read intended blob data only after the correct data-plane role assignment takes effect. That would be evidence for the separate situation: A user has the Azure Reader management-plane role on a storage account and assumes it can download all blob contents.

Authorized responders receive relevant instance operation and security logs for the expected execution interval. That would be evidence for the separate situation: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring.

Creating a service endpoint without setting the service firewall may leave public access broader than intended. This hazard concerns another scenario: A virtual network service endpoint is active for Azure Storage, but the storage account still permits traffic from every public source.

Assuming simple peering is transitive can create unreachable spokes and misleading security-zone expectations. This hazard concerns another scenario: Two peered virtual networks can reach each other, but the architect assumes peering is automatically transitive across a third network.

A functioning private endpoint does not guarantee private connectivity if DNS resolution follows the public path. This hazard concerns another scenario: An Azure Storage account allows only private access but its application still resolves the blob hostname to the public service endpoint.

Inspect Network Watcher next-hop diagnostics and the effective routes on the originating network interface. This is a valid action in another context: A route through a network virtual appliance appears correct but a VM cannot reach a private workload in another subnet.

Review Azure Firewall SKU and feature support, then enable appropriate Premium TLS inspection or IDPS controls where supported. This is a valid action in another context: A security operations team sees threat indicators indicating malicious TLS traffic through Azure Firewall and assumes all tiers inspect encrypted payloads equally.

Resolve overlapping prefixes and refresh compatible peering configurations before dependent workloads migrate. This is a valid action in another context: A network team changes a VNet address space so it overlaps an existing peered network and expects peering to continue normally.

Defender for Cloud supports custom compliance standards using defined assessments and policy mappings. This mechanism is associated with a different case: An Azure enterprise needs a custom organizational cloud security requirement that is absent from its default compliance benchmark.

Defender for Cloud multicloud connectors establish managed access to AWS resources for supported CSPM and protection capabilities. This mechanism is associated with a different case: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.

Cloud vulnerability assessment needs an operational scan path and adequate authorized resource access. This mechanism is associated with a different case: A vulnerability assessment on a VM fails repeatedly because the required identity or service permissions are missing.