Status: OUT
Azure PaaS network access requires alignment across two independently configured layers — infrastructure-level filtering (Standard LB default-deny + NSG stateful rules) and PaaS-level connectivity (service endpoints for subnet-scoped access or Private Link for per-instance backbone isolation) — either layer independently capable of blocking traffic if misconfigured.