Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure, enabling resources to communicate securely with each other, the internet, and on-premises networks. VNets can be connected through VNet peering, which uses Microsoft's private backbone for traffic between networks without traversing the public internet, and through VPN Gateway for encrypted site-to-site or point-to-site connectivity over IPsec/IKE. Azure ExpressRoute provides a private, dedicated connection between on-premises datacenters and Azure for higher reliability, lower latency, and improved security compared with internet-based VPNs. Azure Virtual WAN consolidates branch, user, and internet connectivity through hubs that integrate VPN, ExpressRoute, and point-to-site connections.
Traffic management across Azure is handled by several complementary offerings. Azure Load Balancer distributes inbound and outbound TCP and UDP traffic at OSI Layer 4 across healthy backend instances in a region. Azure Application Gateway is a Layer-7 web traffic load balancer with TLS termination, URL-based routing, cookie-based session affinity, and an integrated Web Application Firewall. Azure Front Door provides global Layer-7 load balancing, SSL offloading, application acceleration, and WAF protection across regions. Azure Traffic Manager operates at the DNS layer to direct clients to the closest or healthiest endpoint using priority, weighted, performance, geographic, multivalue, or subnet routing methods. Azure DNS hosts DNS domains using Microsoft's global infrastructure for both public and private resolution.
Network security is enforced through layered controls. Network Security Groups (NSGs) contain stateful security rules that filter traffic between subnets or network interfaces using five-tuple parameters such as source, destination, port, and protocol. Azure Firewall is a managed, cloud-native firewall with built-in high availability, automatic scaling, application and network filtering, and threat-intelligence integration. Azure DDoS Protection defends resources against distributed denial-of-service attacks; the Basic tier is automatically enabled at no cost, while the Standard tier adds always-on monitoring, adaptive tuning, mitigation analytics, and cost protection credits. Private Endpoints and Private Link bring platform-as-a-service services such as Storage and SQL into a virtual network using private IP addresses so traffic stays on the Microsoft backbone.
Identity is managed by Microsoft Entra ID (formerly Azure Active Directory), a cloud-based identity and access management service that supports authentication and authorization using industry-standard protocols such as SAML 2.0, OpenID Connect, and OAuth 2.0. Single sign-on to thousands of pre-integrated SaaS applications is enabled through these protocols. Conditional Access evaluates signals such as user, location, device state, application, and real-time risk to enforce policies including multi-factor authentication, compliant device requirements, or access blocks. Multi-factor authentication requires two or more verification methods, and passwordless options include FIDO2 keys, Windows Hello for Business, and Microsoft Authenticator. Privileged Identity Management provides just-in-time elevation of administrative roles to reduce standing access. Role-based access control (RBAC) provides fine-grained authorization for Azure resources through role definitions, assignments, and scopes; the built-in Reader role permits view-only access, while Contributor can create and manage resources without granting access to others. Azure Key Vault safeguards cryptographic keys, secrets, and certificates, with the Premium tier offering HSM-protected keys validated to FIPS 140-2 Level 3.