{"id":"service-endpoints-arm-subnet-scoped-no-hybrid","text":"VNet service endpoints are triple-constrained: ARM-only (no classic deployments), subnet-scoped (each subnet independently enabled), and inaccessible from on-premises — requiring IP-based whitelisting for any hybrid connectivity to service-endpoint-secured resources.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"service-endpoints-arm-subnet-scoped-no-hybrid","truth_value":"IN","reason":"premise"}]}}