Azure Networking: Request for Granular Control of “Allow Azure Services and Resources”

I would like to get the Azure community’s thoughts on a networking/security improvement that I believe could help organizations implement a stronger least-privilege model.

Several Azure resources provide an option similar to:

“Allow Azure services and resources to access this resource.”

This is useful when an Azure service needs to access another Azure resource, but the current option can be quite broad.

Example: Power BI → Azure SQL

For example, suppose Power BI Service needs to access an Azure SQL Server.

The actual requirement might be:

Power BI → Specific Azure SQL Server = Allow

However, the available option may require enabling:

“Allow Azure services and resources to access this server”

This effectively creates a much broader trusted-service exception than the actual requirement.

Ideally, I would like to see something like:

Azure SQL Server │ ├── Power BI Service → Allow ├── Azure Data Factory → Deny ├── Azure Functions → Deny ├── Azure App Service → Deny └── Other Azure Services → Deny

Proposed improvement

Could Microsoft provide an additional option such as:

“Allow selected Azure services and resources”

where customers can explicitly select which Azure service/resource is allowed to bypass the network restriction?

Depending on the Azure service, the selection could potentially be based on:

• Specific Azure service
• Specific Azure resource
• Resource ID
• Subscription
• Resource group
• Tenant
• Managed identity / Entra identity
• Specific service instance

For example:

Trusted Azure Services / Resources Power BI → Production Analytics → Allow All other Azure services → Deny

Why I think this would be useful

This would give customers a middle ground between:

1. Disabling public access and implementing Private Endpoint/private connectivity, or
2. Allowing all Azure services/resources through the broad trusted-service exception.

A granular trusted-service model would allow:

Only the Azure service/resource that actually requires access is trusted.

This would better support least privilege, Zero Trust, security, and compliance requirements.

Broader Azure applicability

My suggestion is not specifically for Azure SQL.

The Power BI → Azure SQL scenario is just an example. I think this could be a common Azure networking capability for all Azure resources that currently support a trusted Azure services / “Allow Azure services and resources” type of bypass.

I would be interested to hear from the Azure community and Microsoft:

• Is there already a way to achieve this level of granularity?
• Are there architectural/security reasons why this cannot currently be implemented?
• Is Microsoft considering a more granular trusted-service model?
• Would a feature like “Allow selected Azure services/resources” be technically feasible?

I would appreciate any feedback or guidance from the Azure networking/service teams.