The Azure Cosmos DB network security perimeter facilitates communication among Azure platform as a service (PaaS) resources within a clearly defined trusted boundary. External access can be restricted through network controls applied to all private link resources within this perimeter. All resources inside the perimeter can freely communicate with any other resource within the perimeter, ensuring seamless internal connectivity. Public inbound access can be authorized based on the client's network and identity attributes, such as source IP addresses or subscriptions. Similarly, public outbound access can be approved using the fully qualified domain names of the external destinations.