AZ-700 — frequently asked questions

Seamless Gateway Migration does not support upgrading from a Standard (non-AZ) gateway to an AZ-enabled SKU like ErGw3AZ. Doing so requires a full replacement, causing downtime.

No, High Performance does not support FastPath. Only Ultra Performance and ErGw3AZ SKUs support this feature.

You cannot associate a NAT Gateway with a subnet that contains resources using Basic Public IP addresses, as this would override their direct internet access.

Yes, while the NAT Gateway resource is regional, it must be associated with a specific subnet to handle outbound traffic for VMs within that subnet.

No, resolvers are regional. You must deploy at least one resolver per region where you need to connect VNets or provide endpoints.

While 1 resolver might suffice for one direction, the requirement for Server1 to resolve Azure names requires an inbound endpoint in the Azure region, necessitating a second resolver or complex peering.

RA-GRS adds read-only secondary endpoints for storage1 in its paired region, but the subnet's Microsoft.Storage service endpoint stays region-scoped until a service endpoint policy is applied to that subnet.

Deleting the endpoint drops storage1's current service-endpoint access and does not change the endpoint's regional scope; recreating it returns the same regional endpoint, leaving the paired region unreachable.

Yes. A single DDoS Network Protection plan can be associated with any VNet across all subscriptions within the same Azure AD tenant.

No. The pricing is flat per tenant/per region pair, regardless of the number of public IP addresses protected by the linked VNets.

No. A single service endpoint for 'Microsoft.Storage' secures traffic to all storage accounts accessible from that subnet.

No. Peering provides connectivity, but you must still explicitly enable the service endpoint policy on the subnet to restrict access and optimize routing.

An alias specifies the service type (e.g., Microsoft.Storage), not a specific resource. To target storage1, you must add it as a resource.

No, enabling the endpoint allows traffic from the subnet to the service, but a Service Endpoint Policy is needed to restrict that traffic to specific resources.

Delegation assigns subnet control to a specific Azure service provider. Since Private Endpoints are managed by the Virtual Network infrastructure, they conflict with delegation.

No. Private endpoints rely on the Azure backbone and UDRs for routing. A load balancer is used for inbound/outbound traffic distribution, not internal endpoint routing.

Native IKEv2 on macOS does not support the protocol extensions required for Microsoft Entra ID authentication, necessitating the OpenVPN client.

No, Windows devices support both the native IKEv2 client and the OpenVPN client for Entra ID authentication, offering more flexibility than macOS.

Yes, a single Connection Monitor resource can monitor multiple endpoint pairs, including those in different Azure regions and on-premises locations.

Network Watcher is a regional control plane. You don't need a new instance in every region to perform monitoring; Connection Monitor in one region can handle cross-region checks.

Yes, an ASG is a logical grouping that can include VMs from any VNet in the same subscription or via peering, provided they are in the same tenant.

A single ASG cannot enforce directional restrictions between its members easily. Separate groups allow precise NSG rules defining who can talk to whom.

No, rate limiting is a feature provided by Azure WAF custom rules when integrated with Front Door Premium.

Yes, when a WAF policy is associated with a Front Door profile, its rules apply to all backend pools and endpoints managed by that profile.

NSGs attach to subnets and NICs to filter layer-4 traffic; they cannot be attached to a Virtual WAN hub, so they never change Hub1's Unsecured status.

Yes. Only an in-hub Azure Firewall managed by Azure Firewall Manager (or an equivalent managed NVA) converts Hub1 to a secured virtual hub; a spoke firewall leaves the status Unsecured.

A raw IP rule can be error-prone and harder to maintain; AzurePlatformIMDS is the supported service tag that represents the IMDS endpoint and requires less administrative effort.

IMDS requests are initiated outbound from the VM to 169.254.169.254. An inbound rule does not stop that request, and default inbound rules already deny unsolicited inbound traffic.

No. It aggregates by the full five-tuple including Source IP, Destination IP, Source Port, Destination Port, and Protocol.

Different source ports mean the connections are distinct flows. Even if destination IPs/ports are the same, differing source ports create separate aggregated entries.

Azure Firewall provides its own SNAT for outbound traffic; a NAT gateway is used for outbound connectivity when not routing through a firewall, not for TLS decryption.

The firewall's managed identity is represented as an enterprise application; granting it access to the Key Vault certificate is required for TLS inspection.

No, only General Purpose v2 standard storage accounts are supported for storing packet capture files.

If you select the local file path option, captures are saved directly to the VM's disk (e.g., /var/captures on Linux).

Adding a route changes the path but does not bypass Azure Firewall application rules. If the Firewall blocks the traffic, the route change alone will not enable activation.

Yes, Azure Firewall Network Rules can utilize Service Tags to simplify management of destination addresses for known Azure services.

A Private Endpoint connects to a specific Azure service resource. For a VM, you must expose it via a Private Link Service, which requires a Load Balancer frontend IP configuration.

No, when used with Private Link, the Standard Load Balancer should be configured without a public IP address to ensure traffic remains within the Azure backbone.

A single plan can be associated with up to 100 virtual networks across subscriptions in the same tenant, so you do not need one plan per VNet or subscription.

No, DDoS IP Protection is enabled per public IP address and does not require a DDoS protection plan, unlike DDoS Network Protection.

Yes, an ExpressRoute circuit can be shared by multiple virtual networks regardless of which Azure subscription they belong to, provided they are in the same geopolitical region.

Both regions fall under the same geopolitical region (Americas), allowing a single Standard ExpressRoute circuit to provide connectivity to virtual networks in either region.

Yes, ExpressRoute Global Reach is available on both Standard and Premium SKUs. Using Standard helps minimize costs compared to upgrading to Premium.

Yes, Global Reach works between any two ExpressRoute circuits, regardless of whether they are in the same or different geographical regions, such as East US and West US.