Azure Firewall vs NSGs: A Defense-in-Depth Security Model

NSGs and Azure Firewall stop different attacks. Here's the default-rule bypass that lets lateral movement and exfiltration slip past a hub firewall.