NSG vs Azure Firewall vs WAF: Stop Mixing Them Up

The exam rarely asks what a tool is. It asks which tool fits. In networking, four controls come up again and again, and they sound alike: network security groups, Azure Firewall, a web application firewall, and private endpoints.

Here is the short version, then each one as it looks in the SC-500 lab.

Control	Does	Use it when
NSG	allows or denies traffic by IP and port	on every subnet
Azure Firewall	central rules by FQDN, plus threat intelligence	many networks share one exit
WAF	blocks web attacks such as SQL injection	public web apps
Private endpoint	gives a PaaS service a private IP	there must be no public access at all

Network security group: the basic fence

An NSG filters by priority (100 to 4096, lowest first), source, destination, port and protocol. Its default rules allow traffic inside the virtual network and deny everything else inbound. With application security groups you write rules by role, web to app on port 8080, and they keep working whatever the IP addresses become.

If there is an NSG on both the subnet and the network card, traffic must pass both.

Private endpoint: no public door at all

A private endpoint is a network card in your subnet with a private address, connected to one part of one service: a key vault, a blob service, a SQL server. Then you can turn public access off on the service itself.

The step people miss is DNS. Without the private DNS zone, the name still resolves to the public address and the traffic never uses the endpoint.

Service endpoint or private endpoint? A service endpoint is free and works per subnet, but the service keeps its public address. A private endpoint gives each resource a private address that also works from on-premises and peered networks.

Azure Firewall: one exit for many networks

The firewall lives in a hub network; application networks are spokes, and a route table sends their traffic to the firewall’s private address. A firewall policy holds the rules: DNAT first, then network rules, then application rules.

Tiers matter for the exam: Basic for small sites (threat intelligence can only alert), Standard adds threat-intelligence deny, DNS proxy and web categories, and Premium adds TLS inspection, IDPS and full URL filtering. A firewall is billed by the hour even with no traffic, so in the lab we create it and delete it in the same lesson.

WAF: stop attacks inside the web request

An NSG or firewall sees IPs, ports and names. A web application firewall reads the HTTP request itself and blocks SQL injection, cross-site scripting and bad bots before they reach the app. In Part 7 we put it in prevention mode and add a custom rule against the sqlmap tool.

How to choose, in one line each

• Need to filter traffic between subnets? NSG (with ASGs).
• Need one controlled exit to the internet for many networks? Azure Firewall in a hub.
• Have a public website or API? Put a WAF in front of it.
• Must a PaaS service never be reachable publicly? Private endpoint, private DNS zone, then public access off.

They are not alternatives; they are layers. A real design uses all four, which is exactly defence in depth.

Exam tip: when the scenario says prevent, think policy, a firewall or guardrails. When it says detect, think Defender plans or Sentinel.