Minimum viable Network security configuration for Fabric (for ISV)

I may be hyperventilating, but is there a need for (from an ISV perspective) to block all internet access to the Fabric and setup a firewall and route all calls to fabric (including app.powerbi.com and app.fabric.microsoft.com ) through this firewall and use VNET internal private links/endpoints to get to the fabric resources?

What's the best practice here (with a special emphasis on ISV business model - I can surely understand for a larger enterprise perspective)? Conversely, why should an ISV not hide their multi-tenant fabric infra behind a firewall?

Please advise/comment/discuss.

Thanks and much appreciated!

2 comments