|
1 | 1 | --- |
2 | | -title: Transition to a network security perimeter in Azure |
| 2 | +title: Transition to a Network Security Perimeter in Azure |
3 | 3 | titleSuffix: Azure Private Link |
4 | | -description: Learn about the different access modes and how to transition to a network security perimeter in Azure. |
| 4 | +description: Learn how to transition to a network security perimeter in Azure, explore access modes, and secure your resources. |
5 | 5 | author: mbender-ms |
6 | 6 | ms.author: mbender |
7 | 7 | ms.service: azure-private-link |
8 | | -ms.custom: |
9 | | - - ignite-2024 |
10 | 8 | ms.topic: overview |
11 | | -ms.date: 11/06/2024 |
| 9 | +ms.date: 05/16/2025 |
12 | 10 | #CustomerIntent: As a network administrator, I want to understand the different access modes and how to transition to a network security perimeter in Azure. |
13 | 11 | --- |
14 | 12 |
|
15 | 13 | # Transition to a network security perimeter in Azure |
16 | 14 |
|
17 | | -In this article, you learn about the different access modes and how to transition to a [network security perimeter](./network-security-perimeter-concepts.md) in Azure. Access modes control the resource's access and logging behavior. |
| 15 | +In this article, you learn about the different access modes and how to transition to a [network security perimeter](./network-security-perimeter-concepts.md) in Azure. Access modes control resource access and logging behavior, helping you secure your Azure resources. |
18 | 16 |
|
19 | 17 | ## Access mode configuration point on resource associations |
20 | 18 |
|
21 | 19 | The **access mode** configuration point is part of a resource association on the perimeter and therefore can be set by the perimeter's administrator. |
22 | 20 |
|
23 | 21 | The property `accessMode` can be set in a resource association to control the resource's public network access. |
24 | 22 |
|
25 | | -The possible values of `accessMode` are currently **Enforced** and **Learning**. |
| 23 | +The possible values of `accessMode` are currently **Enforced** and **Transition**. |
26 | 24 |
|
27 | 25 | | **Access Mode** | **Description** | |
28 | 26 | |-------------|-------------| |
29 | | -| **Learning** | This is the default access mode. Evaluation in this mode will use the network security perimeter configuration as a baseline, but in the case of not finding a matching rule, evaluation will fall back to the resource firewall configuration which can then approve access with existing settings. | |
| 27 | +| **Transition** | This is the default access mode. Evaluation in this mode uses the network security perimeter configuration as a baseline. When it doesn't find a matching rule, evaluation falls back to the resource firewall configuration which can then approve access with existing settings. | |
30 | 28 | | **Enforced** | When explicitly set, the resource obeys **only** network security perimeter access rules. | |
31 | 29 |
|
32 | 30 | ## Prevent connectivity disruptions while adopting network security perimeter |
33 | 31 |
|
34 | | -### Enable Learning mode |
| 32 | +### Enable Transition mode |
35 | 33 |
|
36 | | -To prevent undesired connectivity disruptions while adopting network security perimeter to existing PaaS resources and ensure a smooth transition to secure configurations, administrators can add PaaS resources to network security perimeter in Learning mode. While this step does not secure the PaaS resources, it will: |
| 34 | +To prevent undesired connectivity disruptions while adopting network security perimeter to existing PaaS resources and ensure a smooth transition to secure configurations, administrators can add PaaS resources to network security perimeter in Transition mode (formerly Learning mode). While this step doesn't secure the PaaS resources, it will: |
37 | 35 |
|
38 | 36 | - Allow connections to be established in accordance with the network security perimeter configuration. Additionally, resources in this configuration fallback to honoring resource-defined firewall rules and trusted access behavior when connections aren't permitted by the network security perimeter access rules. |
39 | | -- When diagnostic logs are enabled, generates logs detailing whether connections were approved based on network security perimeter configuration or the resource's configuration. Administrators can then analyse those logs to identify gaps in access rules, missing perimeter memberships, and undesired connections. |
| 37 | +- When diagnostic logs are enabled, generates logs detailing whether connections were approved based on network security perimeter configuration or the resource's configuration. Administrators can then analyze those logs to identify gaps in access rules, missing perimeter memberships, and undesired connections. |
40 | 38 |
|
41 | 39 |
|
42 | 40 | > [!IMPORTANT] |
43 | | -> Operating PaaS resources in **Learning** mode should serve only as a transitional step. Malicious actors may exploit unsecured resources to exfiltrate data. Therefore, it is crucial to transition to a fully secure configuration as soon as possible with the access mode set to **Enforced**. |
| 41 | +> Operating PaaS resources in **Transition (formerly Learning)** mode should serve only as a transitional step. Malicious actors may exploit unsecured resources to exfiltrate data. Therefore, it's crucial to transition to a fully secure configuration as soon as possible with the access mode set to **Enforced**. |
44 | 42 |
|
45 | 43 | ### Transition to enforced mode for existing resources |
46 | 44 |
|
47 | | -To fully secure your public access, it is essential to move to enforced mode in network security perimeter. Things to consider before moving to enforced mode are the impact on public, private, trusted, and perimeter access. When in enforced mode, the behavior of network access on associated PaaS resources across different types of PaaS resources can be summarised as follows: |
| 45 | +To fully secure your public access, it's essential to move to enforced mode in network security perimeter. Things to consider before moving to enforced mode are the impact on public, private, trusted, and perimeter access. When in enforced mode, the behavior of network access on associated PaaS resources across different types of PaaS resources can be summarized as follows: |
48 | 46 |
|
49 | 47 | - **Public access:** Public access refers to inbound or outbound requests made through public networks. PaaS resources secured by a network security perimeter have their inbound and outbound public access disabled by default, but network security perimeter access rules can be used to selectively allow public traffic that matches them. |
50 | 48 | - **Perimeter access:** Perimeter access refers to inbound or outbound requests between the resources part of the same network security perimeter. To prevent data infiltration and exfiltration, such perimeter traffic will never cross perimeter boundaries unless explicitly approved as public traffic at both source and destination in enforced mode. Manged identity needs to be assigned on resources for perimeter access. |
51 | | -- **Trusted access:** Trusted service access refers to a feature few Azure services that enables access through public networks when its origin is specific Azure services that are considered trusted. Since network security perimeter provides more granular control than trusted access, Trusted access is not supported in enforced mode. |
52 | | -- **Private access:** Access via Private Links is not impacted by network security perimeter. |
| 49 | +- **Trusted access:** Trusted service access refers to a feature few Azure services that enables access through public networks when its origin is specific Azure services that are considered trusted. Since network security perimeter provides more granular control than trusted access, Trusted access isn't supported in enforced mode. |
| 50 | +- **Private access:** Access via Private Links isn't impacted by network security perimeter. |
53 | 51 |
|
54 | 52 | ## Moving new resources into network security perimeter |
55 | 53 |
|
56 | 54 | Network security perimeter supports secure by default behavior by introducing a new property under `publicNetworkAccess` called `SecuredbyPerimeter`. When set, it locks down public access and prevents PaaS resources from being exposed to public networks. |
57 | 55 |
|
58 | 56 | On resource creation, if `publicNetworkAccess` is set to `SecuredByPerimeter`, the resource is created in the lockdown mode even when not associated with a perimeter. Only private link traffic will be allowed if configured. Once associated to a perimeter, network security perimeter governs the resource access behavior. The following table summarizes access behavior in various modes and public network access configuration: |
59 | 57 |
|
60 | | -| **Association access mode** | **Not associated** | **Learning mode** | **Enforced mode** | |
| 58 | +| **Association access mode** | **Not associated** | **Transition mode** | **Enforced mode** | |
61 | 59 | |-----------------|-------------------|-----------------|-----------------| |
62 | 60 | | **Public network access** | | | | |
63 | 61 | | **Enabled** | **Inbound:** Resource rules</br></br>**Outbound** Allowed | **Inbound:** Network security perimeter + Resource rules</br>**Outbound** Network security perimeter rules + Allowed | **Inbound:** Network security perimeter rules</br>**Outbound** Network security perimeter rules | |
|
0 commit comments