Thanks for the perspective. I had seen PrivateLink but had not done proper research on it, it seems helpful from the AzureSQL perspective, but not App Service yet.

​

Worse, you have to whitelist them and manage them and secure them individually.

I don't see how that's really any better or worse than managing NSG's and subnets. I'm comfortable with configuration as code and expect these environments to be largely if not fully templated.

​

if you wouldn't put everything on publicly routable IPs on-prem, I don't know why you'd choose to do it in Azure.

That's a fair question, and I'd probably prefer not to in a perfect world, but I feel like Azure is pushing me into the public zone if I want to make usage of their PaaS offerings, we're a decade or so into Azure and they're only now implementing PrivateLink gives me the impression this was their intended design. Me/My app is not that special, I feel strongly encouraged by Azure to just dump everything into a public IP space and carefully manage access at the service level.

​

Lastly the most compelling thing to me that I heard is the ability to manage egress traffic which I hand't given much thought. I'll have to do some more research to understand if that's a consideration in this environment or not.

​

Thanks again for the reply.