Controller-VM network rules question

Hello,
Currently planing a deployment of moodle using the template.
If I understood the controller-vm shoud not be accessed externally.
If this is the case, why does it have the following network inbound rules?

| Name | Port | Source | Destination | Action |
| -------| -----| -----| -----| -----|
| Allow_http | 80 | Any | Any | Allow |
| AllowAzureLoadBalancerInBound | Any | AzureLoadBalancer | Any | Allow |

I already tried to access the vm from its public ip and gets redirected to the vm-scaleset by the load balancer, but i cant figure out where the redirect is done and why is this even needed.

Thanks for the help and greate job with the template.
Will share any problems if I encounter them.

Thanks for the help.