inbound Private Link does not by itself establish the app's outbound private network route. In this case, a web app needs outbound private reachability to a database subnet. “Configure appropriate outbound VNet integration for the app” would not satisfy that requirement; the supported action is “App Service virtual network integration”. VNet integration supports outbound access from eligible App Service workers to private resources.

private Endpoints enable private inbound connectivity, distinct from outbound VNet integration. In this case, a web app needs outbound private reachability to a database subnet. “An App Service private endpoint for inbound access” would not satisfy that requirement; the supported action is “App Service virtual network integration”. VNet integration supports outbound access from eligible App Service workers to private resources.

slots provide isolated deployment endpoints that can be swapped with production on supported plans. In this case, a web app needs outbound private reachability to a database subnet. “An App Service deployment slot” would not satisfy that requirement; the supported action is “App Service virtual network integration”. VNet integration supports outbound access from eligible App Service workers to private resources.

vNet integration supports outbound access from eligible App Service workers to private resources. In this case, a web app must accept inbound connections privately from a VNet. “App Service virtual network integration” would not satisfy that requirement; the supported action is “An App Service private endpoint for inbound access”. Private Endpoints enable private inbound connectivity, distinct from outbound VNet integration.

slots provide isolated deployment endpoints that can be swapped with production on supported plans. In this case, a web app must accept inbound connections privately from a VNet. “An App Service deployment slot” would not satisfy that requirement; the supported action is “An App Service private endpoint for inbound access”. Private Endpoints enable private inbound connectivity, distinct from outbound VNet integration.

slot-specific settings remain with their slot rather than swapping with application content. In this case, a web app must accept inbound connections privately from a VNet. “Mark the application setting as a deployment-slot setting” would not satisfy that requirement; the supported action is “An App Service private endpoint for inbound access”. Private Endpoints enable private inbound connectivity, distinct from outbound VNet integration.

slots provide isolated deployment endpoints that can be swapped with production on supported plans. In this case, an App Service staging slot is swapped but a secret connection value should stay with that slot. “An App Service deployment slot” would not satisfy that requirement; the supported action is “Mark the application setting as a deployment-slot setting”. Slot-specific settings remain with their slot rather than swapping with application content.

a reverse swap can quickly restore the prior deployed version under an appropriate slot configuration. In this case, an App Service staging slot is swapped but a secret connection value should stay with that slot. “Swap back to the previously working deployment slot when available” would not satisfy that requirement; the supported action is “Mark the application setting as a deployment-slot setting”. Slot-specific settings remain with their slot rather than swapping with application content.

inbound Private Link does not by itself establish the app's outbound private network route. In this case, an App Service staging slot is swapped but a secret connection value should stay with that slot. “Configure appropriate outbound VNet integration for the app” would not satisfy that requirement; the supported action is “Mark the application setting as a deployment-slot setting”. Slot-specific settings remain with their slot rather than swapping with application content.

slots provide isolated deployment endpoints that can be swapped with production on supported plans. In this case, a production website needs new deployment with low-downtime validation. “An App Service deployment slot” would not satisfy that requirement; the supported action is “Deploy to staging, warm and validate, then swap slots”. Staging and slot swap reduce risky direct changes to the live endpoint.

the built-in backup feature can capture eligible app content and configuration for recovery. In this case, a production website needs new deployment with low-downtime validation. “App Service backups where supported by the selected plan” would not satisfy that requirement; the supported action is “Deploy to staging, warm and validate, then swap slots”. Staging and slot swap reduce risky direct changes to the live endpoint.

slot-specific settings remain with their slot rather than swapping with application content. In this case, a production website needs new deployment with low-downtime validation. “Mark the application setting as a deployment-slot setting” would not satisfy that requirement; the supported action is “Deploy to staging, warm and validate, then swap slots”. Staging and slot swap reduce risky direct changes to the live endpoint.

vNet integration supports outbound access from eligible App Service workers to private resources. In this case, a web app must send requests through a private subnet but the team only added an inbound private endpoint. “App Service virtual network integration” would not satisfy that requirement; the supported action is “Configure appropriate outbound VNet integration for the app”. Inbound Private Link does not by itself establish the app's outbound private network route.

private Endpoints enable private inbound connectivity, distinct from outbound VNet integration. In this case, a web app must send requests through a private subnet but the team only added an inbound private endpoint. “An App Service private endpoint for inbound access” would not satisfy that requirement; the supported action is “Configure appropriate outbound VNet integration for the app”. Inbound Private Link does not by itself establish the app's outbound private network route.

the built-in backup feature can capture eligible app content and configuration for recovery. In this case, a web app must send requests through a private subnet but the team only added an inbound private endpoint. “App Service backups where supported by the selected plan” would not satisfy that requirement; the supported action is “Configure appropriate outbound VNet integration for the app”. Inbound Private Link does not by itself establish the app's outbound private network route.

azure subnets in the same virtual network cannot occupy overlapping IP address ranges. In this case, an administrator needs two isolated address ranges for web and database VMs inside one Azure network. “Select a nonoverlapping prefix within the VNet address space” would not satisfy that requirement; the supported action is “Separate subnets within a VNet, each with a nonoverlapping CIDR range”. Subnet boundaries partition VNet address space so security and routing controls can be applied differently.

subnet addresses must fit within the VNet's configured address spaces. In this case, an administrator needs two isolated address ranges for web and database VMs inside one Azure network. “Add an appropriate nonoverlapping VNet address space and create a subnet in it” would not satisfy that requirement; the supported action is “Separate subnets within a VNet, each with a nonoverlapping CIDR range”. Subnet boundaries partition VNet address space so security and routing controls can be applied differently.

address capacity planning prevents exhausting usable IPs as services scale. In this case, an administrator needs two isolated address ranges for web and database VMs inside one Azure network. “Expected host count and Azure-reserved addresses within each subnet” would not satisfy that requirement; the supported action is “Separate subnets within a VNet, each with a nonoverlapping CIDR range”. Subnet boundaries partition VNet address space so security and routing controls can be applied differently.

subnet addresses must fit within the VNet's configured address spaces. In this case, a new subnet creation fails because its CIDR overlaps an existing subnet. “Add an appropriate nonoverlapping VNet address space and create a subnet in it” would not satisfy that requirement; the supported action is “Select a nonoverlapping prefix within the VNet address space”. Azure subnets in the same virtual network cannot occupy overlapping IP address ranges.

subnet boundaries partition VNet address space so security and routing controls can be applied differently. In this case, a new subnet creation fails because its CIDR overlaps an existing subnet. “Separate subnets within a VNet, each with a nonoverlapping CIDR range” would not satisfy that requirement; the supported action is “Select a nonoverlapping prefix within the VNet address space”. Azure subnets in the same virtual network cannot occupy overlapping IP address ranges.

a static private address can preserve the reachable target while respecting subnet address allocation. In this case, a new subnet creation fails because its CIDR overlaps an existing subnet. “A static private IP assignment on the VM NIC within its subnet” would not satisfy that requirement; the supported action is “Select a nonoverlapping prefix within the VNet address space”. Azure subnets in the same virtual network cannot occupy overlapping IP address ranges.

Overlapping subnets are invalid and cannot add address capacity. In this case, a VNet needs another subnet but its current address space has no available range. “Use an overlapping CIDR prefix within an existing subnet” would not satisfy that requirement; the supported action is “Add an appropriate nonoverlapping VNet address space and create a subnet in it”. Subnet addresses must fit within the VNet's configured address spaces.

App Service scaling does not expand VNet address space. In this case, a VNet needs another subnet but its current address space has no available range. “Increase the App Service plan instance count” would not satisfy that requirement; the supported action is “Add an appropriate nonoverlapping VNet address space and create a subnet in it”. Subnet addresses must fit within the VNet's configured address spaces.

Public IPs do not create additional private subnet address capacity. In this case, a VNet needs another subnet but its current address space has no available range. “Assign new VM public IP addresses” would not satisfy that requirement; the supported action is “Add an appropriate nonoverlapping VNet address space and create a subnet in it”. Subnet addresses must fit within the VNet's configured address spaces.

a NIC joins a VNet through a specific subnet reference. In this case, a VM's private IP changes during redeployment but a partner application requires a stable target. “The NIC IP configuration's subnet resource ID” would not satisfy that requirement; the supported action is “A static private IP assignment on the VM NIC within its subnet”. A static private address can preserve the reachable target while respecting subnet address allocation.

vNet internal routing normally exists, so security rules or custom routes may block communication. In this case, a VM's private IP changes during redeployment but a partner application requires a stable target. “Subnet/NIC NSGs and effective routes between the subnets” would not satisfy that requirement; the supported action is “A static private IP assignment on the VM NIC within its subnet”. A static private address can preserve the reachable target while respecting subnet address allocation.

subnet addresses must fit within the VNet's configured address spaces. In this case, a VM's private IP changes during redeployment but a partner application requires a stable target. “Add an appropriate nonoverlapping VNet address space and create a subnet in it” would not satisfy that requirement; the supported action is “A static private IP assignment on the VM NIC within its subnet”. A static private address can preserve the reachable target while respecting subnet address allocation.

subnet addresses must fit within the VNet's configured address spaces. In this case, a team needs a VM reachable from external clients under controlled network rules. “Add an appropriate nonoverlapping VNet address space and create a subnet in it” would not satisfy that requirement; the supported action is “An Azure public IP address associated with an appropriate entry point”. An Azure public IP can expose approved inbound access when combined with suitable routing and firewall policy.

a NIC joins a VNet through a specific subnet reference. In this case, a team needs a VM reachable from external clients under controlled network rules. “The NIC IP configuration's subnet resource ID” would not satisfy that requirement; the supported action is “An Azure public IP address associated with an appropriate entry point”. An Azure public IP can expose approved inbound access when combined with suitable routing and firewall policy.

subnet boundaries partition VNet address space so security and routing controls can be applied differently. In this case, a team needs a VM reachable from external clients under controlled network rules. “Separate subnets within a VNet, each with a nonoverlapping CIDR range” would not satisfy that requirement; the supported action is “An Azure public IP address associated with an appropriate entry point”. An Azure public IP can expose approved inbound access when combined with suitable routing and firewall policy.

subnet addresses must fit within the VNet's configured address spaces. In this case, an architect needs to reserve address space for future internal hosts. “Add an appropriate nonoverlapping VNet address space and create a subnet in it” would not satisfy that requirement; the supported action is “Expected host count and Azure-reserved addresses within each subnet”. Address capacity planning prevents exhausting usable IPs as services scale.

azure subnets in the same virtual network cannot occupy overlapping IP address ranges. In this case, an architect needs to reserve address space for future internal hosts. “Select a nonoverlapping prefix within the VNet address space” would not satisfy that requirement; the supported action is “Expected host count and Azure-reserved addresses within each subnet”. Address capacity planning prevents exhausting usable IPs as services scale.

a static private address can preserve the reachable target while respecting subnet address allocation. In this case, an architect needs to reserve address space for future internal hosts. “A static private IP assignment on the VM NIC within its subnet” would not satisfy that requirement; the supported action is “Expected host count and Azure-reserved addresses within each subnet”. Address capacity planning prevents exhausting usable IPs as services scale.