# Azure Cloud Engineer Interview Questions on Networking and Identity

> Prepare for Azure engineer interviews with answer outlines on NSGs, routing, peering, private endpoints, Azure RBAC versus Entra roles, managed identities, Conditional Access and PIM.

Source: https://www.epifive.com/blog/azure-engineer-interview-networking-identity · Published 2026-10-25 · EpiFive

## Key takeaways

- NSG rules are processed by priority from 100 to 4096, the first matching rule wins, and the built-in default rules sit at 65000 and above and cannot be removed.
- Azure chooses routes by longest prefix match, and for equal prefixes a user-defined route beats a BGP route, which beats a system route.
- Private endpoints put a private IP address from your subnet on a service, while service endpoints leave the service's public IP and DNS unchanged.
- Azure roles manage Azure resources and Microsoft Entra roles manage directory objects, and a Global Administrator does not get Azure access by default.
- System-assigned managed identities share the lifecycle of one resource, while user-assigned identities are standalone and can be shared across resources.

Azure engineer interviews concentrate on two areas: how traffic moves and is filtered in a virtual network, and how identities get permissions. For each topic, give the definition, the rule that decides the outcome (such as NSG priority or longest prefix match), and the place in the portal or the tool where you would verify it. This guide gives answer outlines for the questions asked most often, built from Microsoft's documentation.

## Who this is for

This guide is for candidates for cloud engineer, cloud administrator and infrastructure roles on Azure, and for people preparing after AZ-900 or AZ-104-level study. By the end you will have crisp answers on filtering, routing, peering, private connectivity, role-based access, managed identities, Conditional Access and just-in-time access. If you are earlier in your path, start with [AWS Cloud Practitioner vs AZ-900](https://www.epifive.com/blog/aws-cloud-practitioner-vs-az-900-first) and the [Azure landing zone overview for small businesses](https://www.epifive.com/blog/azure-landing-zone-small-business).

## Answer pattern

For every question use the same four beats: what it is, the deciding rule, a failure you have seen or can describe from a lab, and how you would check it. Interviewers can then probe in any direction.

## Networking questions

### How do network security groups work?

A network security group (NSG) filters traffic between Azure resources in a virtual network using security rules. Each rule has a name, a priority between 100 and 4096, a source and destination (any, an IP address, a CIDR block, a service tag or an application security group), a protocol (TCP, UDP, ICMP, ESP, AH or Any), a direction, a port range and an action of allow or deny.

Key points to state:

- Rules are processed in priority order, lower numbers first, and processing stops at the first match.
- Rules are evaluated on the five-tuple of source, source port, destination, destination port and protocol. You cannot create two rules with the same priority and direction.
- NSGs are stateful. If you allow outbound traffic on port 80, you do not need an inbound rule for the response.
- Removing a rule does not break existing connections. Rule changes only affect new connections, so an open SSH session survives deleting the rule that allowed it.
- You cannot remove the default rules, but you can override them with higher-priority rules.

| Default rule | Direction | Priority | Behavior |
| --- | --- | --- | --- |
| AllowVNetInBound | Inbound | 65000 | Allow VirtualNetwork to VirtualNetwork |
| AllowAzureLoadBalancerInBound | Inbound | 65001 | Allow AzureLoadBalancer |
| DenyAllInbound | Inbound | 65500 | Deny everything else |
| AllowVnetOutBound | Outbound | 65000 | Allow VirtualNetwork to VirtualNetwork |
| AllowInternetOutBound | Outbound | 65001 | Allow to Internet |
| DenyAllOutBound | Outbound | 65500 | Deny everything else |

Follow-up you can volunteer: security admin rules from Azure Virtual Network Manager are evaluated before NSG rules, and "Always allow" and "Deny" admin rules end evaluation before NSG rules are consulted. Also mention that Microsoft states NSG flow logs retire on 30 September 2027 and that virtual network flow logs are the replacement.

### A VM cannot reach another VM. How do you troubleshoot?

1. Check effective security rules on the network interface, including NSGs on both the subnet and the NIC.
2. Check effective routes on the source NIC for the next hop.
3. Use Network Watcher connectivity check to see how traffic is routed from the source NIC to the destination NIC. Microsoft's peering documentation points to it for troubleshooting connectivity between peered virtual networks.
4. Check the guest operating system firewall and whether the service listens on the port.

### How does Azure route traffic?

Azure creates a route table for each subnet with system routes: one for each address range in the virtual network (next hop Virtual network), 0.0.0.0/0 to Internet, and None routes for several private and reserved prefixes such as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 unless you use those ranges in your address space. Azure adds optional routes when you enable peering, a virtual network gateway or a service endpoint.

To override, you create user-defined routes (UDRs) in a route table associated with a subnet. Next hop types include Virtual appliance, Virtual network gateway, None, Virtual network and Internet. Selection works like this:

- Azure picks the route with the longest prefix match for the destination.
- If prefixes are identical, a UDR beats a BGP route, which beats a system route.
- Routes for virtual network, peering and service endpoints are preferred even over more specific BGP routes.

A virtual appliance next hop needs IP forwarding enabled on the NIC. Microsoft also advises deploying the appliance in a different subnet from the workloads that route through it, to avoid routing loops. A 0.0.0.0/0 route to an appliance sends all internet-bound traffic through it, and you should not associate such a route table with a VPN gateway's gateway subnet. Related reading: [Azure default outbound access and NAT gateway](https://www.epifive.com/blog/azure-default-outbound-access-nat-gateway).

### What is virtual network peering?

Peering connects two virtual networks so they behave as one for connectivity, with traffic kept on the Microsoft backbone. Local peering connects virtual networks in one region, and global peering connects them across regions. Latency between peered virtual machines in the same region matches latency inside a single network. Points to know:

- Peering works across subscriptions and Microsoft Entra tenants.
- NSGs still apply, and full connectivity between peered networks is the default.
- You pay a nominal fee for ingress and egress traffic over a peering.
- A virtual network can have only one gateway, and gateway transit lets a peered network use another network's VPN or ExpressRoute gateway. The network using the remote gateway cannot have its own.
- For hub-and-spoke designs, service chaining uses UDRs to send spoke traffic to a firewall or other appliance in the hub. See [Azure hub-spoke network with a firewall](https://www.epifive.com/blog/azure-hub-spoke-network-firewall).
- Peering resizing: you can change address spaces without downtime, but peers must sync afterwards.

### Service endpoint or private endpoint?

| | Service endpoint | Private endpoint |
| --- | --- | --- |
| What it is | Extends your virtual network identity to a service over the backbone | A network interface with a private IP in your subnet, connected to a Private Link resource |
| DNS | Unchanged, still resolves to the service's public IP | Needs DNS that resolves the service name to the private IP, often a private DNS zone |
| Source IP seen by service | Virtual network private IP instead of public IP | Private IP |
| On-premises access | Cannot be used from on-premises services | Reachable from on-premises over VPN or ExpressRoute |
| Microsoft's guidance | Still supported | Recommended for secure private access |

Add that a private endpoint does not by itself restrict public network access to a service, and that you need a separate private endpoint per sub-resource, such as blob and file for Azure Storage. A private endpoint must be in the same region and subscription as its virtual network, but the target resource can be elsewhere. Connection states are Approved, Pending, Rejected and Disconnected, and only Approved connections carry traffic.

## Identity questions

### Azure RBAC roles versus Microsoft Entra roles

| | Azure roles | Microsoft Entra roles |
| --- | --- | --- |
| Manage | Azure resources | Entra resources such as users, groups, domains |
| Scope | Management group, subscription, resource group, resource | Tenant, administrative unit, individual object |
| Seen in | Access control (IAM) pages in the Azure portal | Roles and administrators in the Entra admin center |

The five fundamental Azure roles are Owner, Contributor, Reader, Role Based Access Control Administrator and User Access Administrator. Contributor cannot assign roles, which is a common follow-up. By default the two systems do not overlap: a Global Administrator has no Azure resource access unless they turn on the **Access management for Azure resources** switch, which grants the User Access Administrator role on all subscriptions in the tenant. Classic subscription administrator roles are retired, and Microsoft says that from May 2026 you must use Azure RBAC.

### Managed identities

A managed identity lets an Azure resource obtain Microsoft Entra tokens without storing credentials, and costs nothing extra.

| | System-assigned | User-assigned |
| --- | --- | --- |
| Created | With the resource | As a standalone resource |
| Lifecycle | Deleted with the resource | Independent, must be deleted explicitly |
| Sharing | One resource only | Many resources |
| Typical use | Workload on a single resource | Several resources needing the same identity or pre-authorization |

The usual steps are to create or enable the identity, grant it a role on the target resource, then have code obtain a token with MSAL or the Azure.Identity library. Say "no secret to rotate or leak" in the answer.

### What does Conditional Access do?

It is Microsoft's Zero Trust policy engine: if-then policies that combine signals (user or group, IP location, device, application, real-time risk, Microsoft Defender for Cloud Apps) with decisions (block, or grant with requirements such as multifactor authentication, authentication strength, compliant device, hybrid joined device, approved client app, app protection policy, password change or terms of use). Policies are enforced after first-factor authentication completes, and Conditional Access is not a front-line defense against denial of service. Common policies are MFA for administrators, MFA for Azure management, blocking legacy authentication, and requiring managed devices. It needs Microsoft Entra ID P1, and risk-based policies need ID Protection (P2). When licences expire, policies are not deleted but can't be updated. Security defaults are available to all customers. For design depth, see [authentication strengths for phishing-resistant admins](https://www.epifive.com/blog/authentication-strengths-phishing-resistant-admins).

### What is Privileged Identity Management?

PIM provides just-in-time, time-bound, approval-based role activation for Microsoft Entra roles, Azure resource roles and PIM for Groups. Eligible assignments need activation, which can include MFA, a justification and approval; active assignments need no action. It also supports notifications, access reviews and audit history, and it prevents removing the last active Global Administrator. It requires licences, so check current licensing.

## Scenario prompts to practise

- Design access so that a storage account is reachable only from one subnet and from on-premises.
- A new spoke cannot reach on-premises even though the hub has a VPN gateway. Which peering settings do you check?
- A developer needs to deploy resources into one resource group for one week, and nothing else.
- An application on a VM needs to read blobs without secrets in configuration.

For each, name the control, the scope and how you would test it.

## Checklist

- You can explain NSG priority, statefulness and the default rules.
- You can describe route selection: longest prefix, then UDR, BGP, system.
- You can compare peering, service endpoints and private endpoints.
- You can separate Azure roles from Entra roles, and explain elevation.
- You can describe managed identities, Conditional Access and PIM, with licence notes.

## References

- Azure network security groups overview: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
- Azure virtual network traffic routing: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview
- Azure Virtual Network peering: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview
- Private endpoint overview: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview
- Virtual network service endpoints: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
- Azure roles, Microsoft Entra roles and classic administrator roles: https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles
- Managed identities for Azure resources: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
- Conditional Access overview: https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
- Privileged Identity Management overview: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

## Frequently asked questions

### What is the difference between Azure RBAC roles and Microsoft Entra roles?

Azure roles control access to Azure resources such as virtual machines and storage, and can be scoped at management group, subscription, resource group or resource level. Microsoft Entra roles control access to Entra resources such as users, groups and domains, scoped at tenant, administrative unit or object level. By default they do not overlap.

### What is the difference between a service endpoint and a private endpoint?

A service endpoint extends your virtual network identity to an Azure service over the backbone, but the service keeps its public IP address and DNS does not change. A private endpoint is a network interface with a private IP address in your virtual network that maps to the service, and Microsoft recommends Private Link and private endpoints for private access.

### Is virtual network peering transitive?

Peering is a direct connection between two virtual networks, and traffic between them stays on the Microsoft backbone. Microsoft's peering documentation describes reaching a third network through a hub with user-defined routes that point to a virtual appliance such as a firewall, which it calls service chaining, so plan for that routing instead of assuming a spoke can reach another spoke automatically.

### Which license does Conditional Access need?

Conditional Access requires Microsoft Entra ID P1, and Microsoft 365 Business Premium customers can also use it. Risk-based policies that use sign-in risk or user risk need Microsoft Entra ID Protection, which is a Microsoft Entra ID P2 feature.