Point-to-Site Azure VPN Interesting Traffic

Hi, with P2S split-tunnel, you can't reliably route only traffic to public PaaS services (e.g. *.database.windows.net / .azuresynapse.net) via VPN: the client doesn't support split tunneling for FQDNs and public IPs change, so static routes break. Correct solutions: 1) Private Link (recommended): Create Private Endpoints for SQL and Synapse, connect the private DNS zones (privatelink.), have P2S clients resolve these FQDNs to the private IPs in the VNet; no allowlists on public IPs. 2) Force-tunnel the entire Internet via Azure and perform SNAT with Azure Firewall: publish the routes 0.0.0.0/1 and 128.0.0.0/1 to clients, UDR from GatewaySubnet→Firewall and back Firewall→Virtual network gateway; then allowlist the firewall's public IP. Avoid: Try to “push” only SQL/Synapse over the VPN while manually maintaining public IPs.