Azure Defense-in-Depth Network Security Layers

Azure network security uses a layered approach, often called defense-in-depth, where different services protect at different levels of the network. This starts with the Virtual Network (VNet), which creates a private, isolated boundary for your resources. Within the VNet, you apply Network Security Groups (NSGs) directly to subnets or network interfaces to perform basic, stateful packet filtering based on IP addresses and ports. For broader perimeter security, you deploy Azure Firewall as a centralized, managed service that can enforce more complex rules across multiple VNets and inspect traffic from Layer 3 (network) up to Layer 7 (application).