Status: IN
Azure enforces default-deny at orthogonal infrastructure layers: Standard Load Balancer blocks all inbound traffic until NSG rules explicitly allow it (network layer), while Storage firewall blocks all requests until trusted networks or IPs are excepted (data layer) — architects must explicitly allowlist at every traffic boundary, not just the network perimeter.