Microsoft just flipped the GA switch on Network Security Perimeter (NSP) for Azure Event Hubs. If you run streaming data workloads, this matters: NSP gives you a way to lock down your Event Hubs namespace so that only resources inside a defined perimeter can reach it. Public internet? Blocked by default. Internal Azure services? Gated by explicit rules you set.
This is not Private Link. It is not VNet Service Endpoints either. NSP operates at the Azure backbone level. It creates a logical boundary around a group of PaaS resources — Event Hubs, but also things like Storage, Key Vault, SQL — and says: “traffic stays inside this fence unless I say otherwise.” You can pair it with Private Endpoints if you want defense in depth, but NSP alone already stops a lot of the leakage that service endpoints do not catch.
What changes for Event Hubs users
Before NSP, if someone got hold of your Event Hubs connection string and your namespace allowed public access, they could stream or read data from anywhere. With NSP in enforced mode, that connection string is useless outside your perimeter. Access requires both authentication (Entra ID) and perimeter membership.
The integration is straightforward. You create an NSP profile, associate your Event Hubs namespace with it, and set the access mode to enforced. Done. Resources inside the profile — say, an Azure Function or an AKS pod in the same perimeter — can still talk to Event Hubs normally. External callers get blocked.
One thing to flag: NSP does not support Shared Access Signature (SAS) tokens for access evaluation inside the perimeter. You need to be using Entra ID authentication. If your existing Event Hubs setup leans heavily on SAS keys, you have migration work to do before turning NSP on.
Limitations worth knowing about
NSP is not a magic wand. A few real-world gotchas:
- No cross-perimeter replication. If you use Event Hubs geo-disaster recovery, NSP does not support replication across perimeters. You need to plan for that or accept the gap.
- Logging is sampled. NSP access logs are captured every 30 minutes and sent to a Log Analytics workspace. You cannot export them elsewhere, and the 30-minute sampling means real-time debugging of access issues is not a thing.
- Not in Gov Cloud yet. As of July 2026, NSP for Event Hubs is GA in commercial Azure but not available in Azure Government regions (Microsoft Learn).
- Pricing is unclear. NSP is free during preview and early GA, but Microsoft has not committed to free forever. Keep an eye on the Event Hubs pricing page.
Should you turn it on?
If your Event Hubs namespace handles anything sensitive — financial transactions, PII, internal telemetry you would rather not leak — the answer is probably yes. The setup is a few clicks in the portal or a couple of PowerShell commands (docs here).
The bigger question is whether your organization has adopted Entra ID broadly enough. If half your services still authenticate with SAS keys, NSP will break them. That is not a reason to skip NSP — it is a reason to finally move off SAS. NSP just gave you a deadline.
For teams already running Private Endpoints, NSP adds another layer without much extra configuration. For teams that have been putting off network hardening because Private Endpoints looked too heavy, NSP is a lighter first step. You get meaningful isolation without provisioning a Private Endpoint per service.