Can NSP (Network Security Perimeter) and Service Endpoint whitelisting co-exist ?

Question

Can NSP (Network Security Perimeter) and Service Endpoint whitelisting co-exist ?

Ashwin Lakhorkar 0 Microsoft Employee

We have our paas services keyvault, storage etc, which gets accessed by aks pods which is sitting in different subscription. as per existing setup aks has service endpoint configured for these paas services and these services have whitelisting for aks subnet. now as a part of security enhancement we have been asked to implement NSP for paas resources. So we wanted to know if NSP and our existing Service Endpoint configuragtion can co-exist ?

Will in anyway NSP imlementation impact our existing setup ??

Ashwin Lakhorkar 0 Reputation points Microsoft Employee

2025-10-15T03:40:15.5766667+00:00

Hi Jeevan Shanigarapu,

Thanks for your response, but the challenge is we can't allow Vnets on NSP, even we can't allow Address Spaces of Vnets as NSP allow listing does not support Private IP spaces.

So practically it's not possible to have AKS Vnet / or its IP space whitelisted, at-least I was getting error saying "NSP does not allow Private IP spaces". Could anyone confirm on this?

Apart from that, what if I whitelist AKS subscription in NSP and have AKS Vnet whitelisting via service endpoint config, I assume that should work !! any thoughts?
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator

2025-10-15T13:11:08.7333333+00:00
Hello @Ashwin Lakhorkar,

You are correct. Currently, NSP does not support whitelisting private IP ranges, so it is not possible to add your AKS subnet directly. If you try to do so, you will receive an error stating, “NSP does not allow Private IP spaces.”

Suggested Method:

Whitelist the entire AKS subscription within your NSP configuration. Ensure that Service Endpoints remain enabled on the AKS subnet for your PaaS services, such as Key Vault and Storage.

This setup, NSP subscription-level access along with Service Endpoint subnet-level routing, provides consistent reliability.

Be sure to test any changes in a non-production environment first.

Note:

NSP provides an additional layer of security, but it does not serve as a replacement for Service Endpoints.

If you need tighter control, you might want to use VPN or ExpressRoute.

Kindly let us know if the above helps or you need further assistance on this issue.

1 answer

Your answer

Ashwin Lakhorkar 0 Reputation points Microsoft Employee

2025-10-15T03:40:15.5766667+00:00

Hi Jeevan Shanigarapu,

Thanks for your response, but the challenge is we can't allow Vnets on NSP, even we can't allow Address Spaces of Vnets as NSP allow listing does not support Private IP spaces.

So practically it's not possible to have AKS Vnet / or its IP space whitelisted, at-least I was getting error saying "NSP does not allow Private IP spaces". Could anyone confirm on this?

Apart from that, what if I whitelist AKS subscription in NSP and have AKS Vnet whitelisting via service endpoint config, I assume that should work !! any thoughts?
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator

2025-10-15T13:11:08.7333333+00:00

Hello @Ashwin Lakhorkar,

You are correct. Currently, NSP does not support whitelisting private IP ranges, so it is not possible to add your AKS subnet directly. If you try to do so, you will receive an error stating, “NSP does not allow Private IP spaces.”

Suggested Method:

Whitelist the entire AKS subscription within your NSP configuration. Ensure that Service Endpoints remain enabled on the AKS subnet for your PaaS services, such as Key Vault and Storage.

This setup, NSP subscription-level access along with Service Endpoint subnet-level routing, provides consistent reliability.

Be sure to test any changes in a non-production environment first.

Note:

NSP provides an additional layer of security, but it does not serve as a replacement for Service Endpoints.

If you need tighter control, you might want to use VPN or ExpressRoute.

Kindly let us know if the above helps or you need further assistance on this issue.

Answer 1

Hello @Ashwin Lakhorkar,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand your question regarding whether NSP (Network Security Perimeter) and Service Endpoint whitelisting can work together, and if implementing NSP will affect your current setup in any way.

Can Network Security Perimeter (NSP) and Service Endpoints Coexist?

Yes, NSP and Service Endpoints can be used together, but there are important considerations:

Service Endpoints: Enable traffic from a designated subnet to Azure PaaS services via the Azure backbone network.

Network Security Perimeter (NSP): Provides extra protection by ensuring access to resources is limited to authorized network perimeters, such as specific VNets, Private Endpoints, or trusted Azure services.

If you enable NSP on a resource that is already using Service Endpoints:

The resource will only allow traffic from networks that have been specifically added to the NSP configuration.

If your AKS subnet, which is currently allowed through Service Endpoints, is not part of the NSP trusted perimeter, the traffic will be denied.

Effect on Your Current Setup

If you add the AKS subnet to the NSP trusted list, your Service Endpoint–based access will work as usual.

If you enable NSP without including the AKS subnet, access from AKS will not work since NSP will enforce its perimeter rules.

NSP is not a replacement for Service Endpoints; rather, it adds another layer of network-level validation. Successful access requires both to be properly aligned.

Note: Before enabling NSP, make sure to review all current consumers (such as AKS, VMs, Logic Apps, etc.) and verify that their subnets or private endpoints are included in the NSP setup. Test any changes in a non-production or staging environment first to ensure there’s no service disruption.

Network security perimeter: What is a network security perimeter? - Azure Private Link | Microsoft Learn

Azure service endpoints: Azure virtual network service endpoints | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to "Accept the answer” and “up-vote it” wherever the information provided helps you, this can be beneficial to other community members__.__ It would be greatly appreciated and helpful to others.

Share via

Can NSP (Network Security Perimeter) and Service Endpoint whitelisting co-exist ?

1 answer

Your answer