Azure Load Balancer rules map supported transport frontend flows to backend ports. In this case, a backend can receive LB traffic but cannot make outbound API calls. “A load-balancing rule defining frontend and backend ports” would not satisfy that requirement; the supported action is “Outbound connectivity and SNAT configuration”. Inbound load balancing and outbound network translation are separate operations.

Load balancing distributes traffic and is not a stable per-VM management mapping. In this case, a backend can receive LB traffic but cannot make outbound API calls. “A scoped inbound NAT rule or safer Bastion access” would not satisfy that requirement; the supported action is “Outbound connectivity and SNAT configuration”. Inbound load balancing and outbound network translation are separate operations.

Inbound NAT can map a frontend port to an individual backend port. In this case, a backend can receive LB traffic but cannot make outbound API calls. “An inbound NAT rule with controlled source/security policy” would not satisfy that requirement; the supported action is “Outbound connectivity and SNAT configuration”. Inbound load balancing and outbound network translation are separate operations.

Backend outbound access depends on an explicit supported SNAT mechanism. In this case, a customer needs a rule that forwards a unique external management port to one VM behind a load balancer. “A supported outbound rule or appropriate NAT Gateway solution” would not satisfy that requirement; the supported action is “An inbound NAT rule with controlled source/security policy”. Inbound NAT can map a frontend port to an individual backend port.

Private service discovery should not rely on globally authoritative public DNS entries. In this case, a customer needs a rule that forwards a unique external management port to one VM behind a load balancer. “Move the record to an appropriate private DNS zone” would not satisfy that requirement; the supported action is “An inbound NAT rule with controlled source/security policy”. Inbound NAT can map a frontend port to an individual backend port.

Virtual network links control where private zone records resolve through Azure DNS. In this case, a customer needs a rule that forwards a unique external management port to one VM behind a load balancer. “An Azure Private DNS zone to the intended VNets” would not satisfy that requirement; the supported action is “An inbound NAT rule with controlled source/security policy”. Inbound NAT can map a frontend port to an individual backend port.

Health probes test readiness but do not create traffic forwarding rules. In this case, a team tries to use a load-balancing rule to reach a particular single VM's admin port deterministically. “A load-balancing rule for the intended frontend and backend” would not satisfy that requirement; the supported action is “A scoped inbound NAT rule or safer Bastion access”. Load balancing distributes traffic and is not a stable per-VM management mapping.

Backend outbound access depends on an explicit supported SNAT mechanism. In this case, a team tries to use a load-balancing rule to reach a particular single VM's admin port deterministically. “A supported outbound rule or appropriate NAT Gateway solution” would not satisfy that requirement; the supported action is “A scoped inbound NAT rule or safer Bastion access”. Load balancing distributes traffic and is not a stable per-VM management mapping.

Private service discovery should not rely on globally authoritative public DNS entries. In this case, a team tries to use a load-balancing rule to reach a particular single VM's admin port deterministically. “Move the record to an appropriate private DNS zone” would not satisfy that requirement; the supported action is “A scoped inbound NAT rule or safer Bastion access”. Load balancing distributes traffic and is not a stable per-VM management mapping.

Autoregistration can automatically maintain eligible VM host records. In this case, a DNS name should resolve only within a set of VNets, without public records. “Enable autoregistration on the appropriate Private DNS VNet link” would not satisfy that requirement; the supported action is “An Azure Private DNS zone to the intended VNets”. Virtual network links control where private zone records resolve through Azure DNS.

Resolution and dynamic record registration are different link capabilities. In this case, a DNS name should resolve only within a set of VNets, without public records. “Automatic registration was not enabled for that link” would not satisfy that requirement; the supported action is “An Azure Private DNS zone to the intended VNets”. Virtual network links control where private zone records resolve through Azure DNS.

Using custom DNS changes how the client reaches Azure-linked private zones. In this case, a DNS name should resolve only within a set of VNets, without public records. “Custom resolver forwarding to Azure-provided DNS or a Private Resolver” would not satisfy that requirement; the supported action is “An Azure Private DNS zone to the intended VNets”. Virtual network links control where private zone records resolve through Azure DNS.

Autoregistration can automatically maintain eligible VM host records. In this case, an engineer adds an internal record to Azure public DNS and exposes the hostname. “Enable autoregistration on the appropriate Private DNS VNet link” would not satisfy that requirement; the supported action is “Move the record to an appropriate private DNS zone”. Private service discovery should not rely on globally authoritative public DNS entries.

Resolution and dynamic record registration are different link capabilities. In this case, an engineer adds an internal record to Azure public DNS and exposes the hostname. “Automatic registration was not enabled for that link” would not satisfy that requirement; the supported action is “Move the record to an appropriate private DNS zone”. Private service discovery should not rely on globally authoritative public DNS entries.

Load balancing distributes traffic and is not a stable per-VM management mapping. In this case, an engineer adds an internal record to Azure public DNS and exposes the hostname. “A scoped inbound NAT rule or safer Bastion access” would not satisfy that requirement; the supported action is “Move the record to an appropriate private DNS zone”. Private service discovery should not rely on globally authoritative public DNS entries.

Private service discovery should not rely on globally authoritative public DNS entries. In this case, an app uses Azure Private DNS but needs automatic records for VMs in one VNet. “Move the record to an appropriate private DNS zone” would not satisfy that requirement; the supported action is “Enable autoregistration on the appropriate Private DNS VNet link”. Autoregistration can automatically maintain eligible VM host records.

Virtual network links control where private zone records resolve through Azure DNS. In this case, an app uses Azure Private DNS but needs automatic records for VMs in one VNet. “An Azure Private DNS zone to the intended VNets” would not satisfy that requirement; the supported action is “Enable autoregistration on the appropriate Private DNS VNet link”. Autoregistration can automatically maintain eligible VM host records.

Using custom DNS changes how the client reaches Azure-linked private zones. In this case, an app uses Azure Private DNS but needs automatic records for VMs in one VNet. “Custom resolver forwarding to Azure-provided DNS or a Private Resolver” would not satisfy that requirement; the supported action is “Enable autoregistration on the appropriate Private DNS VNet link”. Autoregistration can automatically maintain eligible VM host records.

Private zone linkage alone may not help clients that query unrelated resolvers. In this case, a VNet link is resolution-only, and new VM records are not created automatically. “Configure appropriate DNS forwarding to the Azure private resolution path” would not satisfy that requirement; the supported action is “Automatic registration was not enabled for that link”. Resolution and dynamic record registration are different link capabilities.

Using custom DNS changes how the client reaches Azure-linked private zones. In this case, a VNet link is resolution-only, and new VM records are not created automatically. “Custom resolver forwarding to Azure-provided DNS or a Private Resolver” would not satisfy that requirement; the supported action is “Automatic registration was not enabled for that link”. Resolution and dynamic record registration are different link capabilities.

Virtual network links control where private zone records resolve through Azure DNS. In this case, a VNet link is resolution-only, and new VM records are not created automatically. “An Azure Private DNS zone to the intended VNets” would not satisfy that requirement; the supported action is “Automatic registration was not enabled for that link”. Resolution and dynamic record registration are different link capabilities.

Autoregistration can automatically maintain eligible VM host records. In this case, a VM's DNS queries use custom DNS servers and ignore an Azure private zone link. “Enable autoregistration on the appropriate Private DNS VNet link” would not satisfy that requirement; the supported action is “Custom resolver forwarding to Azure-provided DNS or a Private Resolver”. Using custom DNS changes how the client reaches Azure-linked private zones.

Resolution and dynamic record registration are different link capabilities. In this case, a VM's DNS queries use custom DNS servers and ignore an Azure private zone link. “Automatic registration was not enabled for that link” would not satisfy that requirement; the supported action is “Custom resolver forwarding to Azure-provided DNS or a Private Resolver”. Using custom DNS changes how the client reaches Azure-linked private zones.

Loopback-only listeners may not serve probe connections from the load balancer. In this case, a VM's DNS queries use custom DNS servers and ignore an Azure private zone link. “A listener bound to reachable network interfaces and correct probe settings” would not satisfy that requirement; the supported action is “Custom resolver forwarding to Azure-provided DNS or a Private Resolver”. Using custom DNS changes how the client reaches Azure-linked private zones.

Autoregistration can automatically maintain eligible VM host records. In this case, a custom DNS server has no forwarding rule for privatelink names. “Enable autoregistration on the appropriate Private DNS VNet link” would not satisfy that requirement; the supported action is “Configure appropriate DNS forwarding to the Azure private resolution path”. Private zone linkage alone may not help clients that query unrelated resolvers.

Resolution and dynamic record registration are different link capabilities. In this case, a custom DNS server has no forwarding rule for privatelink names. “Automatic registration was not enabled for that link” would not satisfy that requirement; the supported action is “Configure appropriate DNS forwarding to the Azure private resolution path”. Private zone linkage alone may not help clients that query unrelated resolvers.

Loopback-only listeners may not serve probe connections from the load balancer. In this case, a custom DNS server has no forwarding rule for privatelink names. “A listener bound to reachable network interfaces and correct probe settings” would not satisfy that requirement; the supported action is “Configure appropriate DNS forwarding to the Azure private resolution path”. Private zone linkage alone may not help clients that query unrelated resolvers.

Centralized private zone linking reduces record drift where appropriate. In this case, a backend in a load balancer pool fails a health probe but app traffic seems fine locally. “Use shared zone management and approved VNet links” would not satisfy that requirement; the supported action is “Probe protocol/port, NSG allowance and service listening binding”. Probe health depends on backend reachability, not only a local loopback test.

Private DNS zone linkage can span subscription boundaries with permissions. In this case, a backend in a load balancer pool fails a health probe but app traffic seems fine locally. “Create authorized virtual network links across the intended subscriptions” would not satisfy that requirement; the supported action is “Probe protocol/port, NSG allowance and service listening binding”. Probe health depends on backend reachability, not only a local loopback test.

Private zone linkage alone may not help clients that query unrelated resolvers. In this case, a backend in a load balancer pool fails a health probe but app traffic seems fine locally. “Configure appropriate DNS forwarding to the Azure private resolution path” would not satisfy that requirement; the supported action is “Probe protocol/port, NSG allowance and service listening binding”. Probe health depends on backend reachability, not only a local loopback test.

Private DNS zone linkage can span subscription boundaries with permissions. In this case, a VM accepts localhost HTTP but the LB marks it unhealthy. “Create authorized virtual network links across the intended subscriptions” would not satisfy that requirement; the supported action is “A listener bound to reachable network interfaces and correct probe settings”. Loopback-only listeners may not serve probe connections from the load balancer.

Using custom DNS changes how the client reaches Azure-linked private zones. In this case, a VM accepts localhost HTTP but the LB marks it unhealthy. “Custom resolver forwarding to Azure-provided DNS or a Private Resolver” would not satisfy that requirement; the supported action is “A listener bound to reachable network interfaces and correct probe settings”. Loopback-only listeners may not serve probe connections from the load balancer.

Centralized private zone linking reduces record drift where appropriate. In this case, a VM accepts localhost HTTP but the LB marks it unhealthy. “Use shared zone management and approved VNet links” would not satisfy that requirement; the supported action is “A listener bound to reachable network interfaces and correct probe settings”. Loopback-only listeners may not serve probe connections from the load balancer.