Cascade Regional Airlines wants to restrict an Azure SQL Database's firewall so it only accepts connections originating from the crew-scheduling subnet, while traffic still travels over the Azure backbone to the database's existing public endpoint, with no new network interface or private IP address required. Which feature satisfies this?

A service endpoint extends a subnet's identity onto the Azure backbone network for a specific PaaS service, allowing that service's firewall — in this case, Azure SQL Database's server-level firewall — to permit traffic based on the source subnet itself, while the database's endpoint remains its existing public one and no private IP or new network interface is provisioned. This is the direct opposite trade-off from a private endpoint: private endpoints require DNS changes to resolve the service's hostname to a new private IP, and this scenario explicitly rules that out, making the private-endpoint distractor incorrect despite it being a plausible-sounding networking feature. A NAT gateway filters and translates outbound traffic for internet-bound connections leaving a subnet; it has no concept of a downstream service's firewall rules and cannot restrict access to Azure SQL Database at all. Application security groups group VM network interfaces for use in NSG rules; they cannot be referenced in an Azure SQL Database firewall, which understands IP ranges, virtual network rules (service endpoints), and, separately, private endpoint connections — not ASGs. Once the service endpoint is enabled on the subnet and the corresponding virtual network rule is added to the SQL Database firewall, Cascade's team should test connectivity from a VM in that subnet and confirm connections from outside it are still rejected.