Status: OUT
Azure's two nominally orthogonal security planes (governance via RBAC/Policy and network via NSG/LB) share a hidden infrastructure coupling through DNS: the 168.63.129.16 virtual IP underpins both health probing (network plane operational dependency) and recursive name resolution (required by all service discovery), creating a single point of operational risk that compounds with DNS cross-VNet asymmetries to undermine the zero-trust assumptions of both planes.