After Lab 2.3 — Recap

The access restriction blocked the direct path while leaving the expected one working.

The application works the same way it did before. The only thing that changed is that a public IP can no longer call the internal backend directly.

Figuur 0: App Service access restriction rule in the Azure Portal — source set to the app integration subnet

Key takeaway

Network segmentation removes attack surface without changing application behaviour.

---

Bridge to Lab 2.4

The internal backend is now restricted. The DB storage account still has public network access enabled — that is what Lab 2.4 addresses.