[gxt]

I'll take this opportunity to remind anyone on Azure that if you enable service endpoints on a subnet without applying service endpoint policies, anyone with the resourceid of an affected subnet can silently backdoor your network. Your NSGs do not matter for service endpoints.

[guptadagger]

Backdoora private network how? Or do you just mean that an NSG wont apply like you might have expected?