Skip to content

Commit 78a0b41

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #297512 from ivapplyr/private-link-HSPE
Private Link Increase Private Endpoint Virtual Network Limits #NewArticle
2 parents 5fe6610 + 6500c62 commit 78a0b41

File tree

2 files changed

+192
-0
lines changed

2 files changed

+192
-0
lines changed

‎articles/private-link/increase-private-endpoint-vnet-limits.md

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
---
2+
title: Increase Private Endpoint virtual network limits
3+
titleSuffix: Azure Private Link
4+
description: Learn how to increase private endpoints virtual network limits by upgrading to High Scale Private Endpoints.
5+
services: private-link
6+
author: ivapplyr
7+
ms.author: ivapplyr
8+
ms.date: 04/01/2025
9+
ms.service: azure-private-link
10+
ms.topic: how-to
11+
#customer intent: As a network administrator, I want to increase private endpoint limits so that I can scale my virtual network infrastructure effectively.
12+
---
13+
14+
# How-to: Increase Private Endpoint virtual network limits
15+
16+
Today, users are [limited](/azure/azure-resource-manager/management/azure-subscription-service-limits) to deploying only 1,000 private endpoints within their virtual network. It's common for users to navigate around this limitation by implementing a [Hub and Spoke](/azure/cloud-adoption-framework/ready/azure-best-practices/hub-spoke-network-topology) model or a [Mesh network](/azure/virtual-network-manager/concept-connectivity-configuration). Doing so would make it possible to deploy extra private endpoints across peered virtual networks to temporarily surpass the per virtual network limit. However, scaling in this manner places users at risk of a silently enforced limitation. Whenever users surpass 4,000 private endpoints across their peered virtual networks, they put themselves at risk of connectivity issues and packet drops.
17+
18+
For users looking to surpass these current limits, we recommend upgrading to *High Scale Private Endpoints*. This feature increases standard limits to 5,000 private endpoints in a singular virtual network and 20,000 private endpoints across peered networks. This article details how to opt into this feature and provide extra considerations before enablement.
19+
20+
> [!NOTE]
21+
> This feature is currently in public preview and available in select regions. We recommend reviewing all considerations before enabling it for your subscription.
22+
23+
## Prerequisites
24+
25+
* An active Azure account with a subscription. [Create an account for free](https://azure.microsoft.com/free/).
26+
* Register feature flag Microsoft.Network/EnableMaxPrivateEndpointsVia64kPath on current subscription, see [Enable Azure preview features](/azure/azure-resource-manager/management/preview-features).
27+
* Understanding of [Hub and Spoke](/azure/cloud-adoption-framework/ready/azure-best-practices/hub-spoke-network-topology) or [Mesh network](/azure/virtual-network-manager/concept-connectivity-configuration) topology.
28+
* A virtual network with private endpoint configured, see [Create a private endpoint](/azure/private-link/create-private-endpoint-portal).
29+
* Private Endpoint Network Policies set to **Enabled** or **RouteTableEnabled** for all Private Endpoint Subnets, see [Manage network policies for private endpoints](/azure/private-link/disable-private-endpoint-network-policy).
30+
31+
### Confirm if you need to upgrade
32+
33+
If you need more than 1,000 private endpoints in a single virtual network or encounter a max private endpoint limit error, consider upgrading to *High Scale Private Endpoints*.
34+
35+
For customers using a Hub and Spoke or Mesh topology, determine how many private endpoints are connected to your central virtual network containing client virtual machines. Use the provided ARG query to facilitate this process.
36+
37+
```Azure Resource Graph
38+
Resources
39+
40+
| where subscriptionId == "\<yourSubscriptionIDHere>"
41+
42+
| where type =~ 'Microsoft.Network/virtualnetworks'
43+
44+
| project id, remoteVNetIds = properties.virtualNetworkPeerings
45+
46+
| mv-expand remoteVNetIds
47+
48+
| project id, remoteVNetId = tostring(remoteVNetIds.properties.remoteVirtualNetwork.id)
49+
50+
| where isnotempty(remoteVNetId)
51+
52+
| join kind=leftouter (
53+
54+
Resources
55+
56+
| where type =~ 'Microsoft.Network/privateEndpoints'
57+
58+
| project id, subnetId = tostring(properties.subnet.id)
59+
60+
| extend VNetId = split(subnetId ,'/subnets/')[0]
61+
62+
| project id, VNetId = tostring(VNetId)
63+
64+
| summarize Count = count() by VNetId)
65+
on $left.remoteVNetId == $right.VNetId
66+
| extend Count = iff(isempty(Count), 0, Count)
67+
| summarize TotalRemotePE = sum(Count) by ['id']
68+
69+
| join kind=leftouter (
70+
71+
Resources
72+
73+
| where type =~ 'Microsoft.Network/privateEndpoints'
74+
75+
| project id, subnetId = tostring(properties.subnet.id)
76+
77+
| extend VNetId = split(subnetId ,'/subnets/')[0]
78+
79+
| project id, VNetId = tostring(VNetId)
80+
81+
| summarize Count = count() by VNetId)
82+
83+
on $left.id == $right.VNetId
84+
85+
| extend TotalPE = iff(isempty(Count), 0, Count) + TotalRemotePE
86+
87+
| project VNetId = id, TotalPE
88+
89+
| order by TotalPE desc
90+
91+
| order by ['VNetId'] asc
92+
93+
```
94+
95+
### Enable High Scale Private Endpoints
96+
97+
To enable this feature, configure *Private Endpoint virtual network Policies*. We recommend enabling this property for all virtual networks you want to include in this feature and for all connected compute virtual networks in peering scenarios.
98+
99+
> [!WARNING]
100+
> Upgrading or downgrading this feature triggers a platform update and results in a one-time connection reset. We recommend performing this action during a maintenance window.
101+
102+
#### [**PowerShell**](#tab/ARG-HSP-Powershell)
103+
104+
```azurepowershell-interactive
105+
$vnetName = "myVirtualNetwork"
106+
$resourceGroupName = "myResourceGroup"
107+
$vnet = Get-AzVirtualNetwork -ResourceGroupName $resourceGroupName -Name $vnetName
108+
109+
$vnet.PrivateEndpointVNetPolicies = "Basic"
110+
$vnet | Set-AzVirtualNetwork
111+
112+
```
113+
114+
#### [**CLI**](#tab/ARG-HSP-CLI)
115+
116+
```azurecli-interactive
117+
vnetName = "myVirtualNetwork"
118+
resourceGroupName="myResourceGroup"
119+
120+
az network vnet update --name $vnetName --resource-group $resourceGroupName --pe-vnet-policies="Basic"
121+
122+
```
123+
124+
---
125+
126+
### Validate configuration
127+
128+
To validate the configuration, verify all necessary properties are set correctly. You can do this by checking the following:
129+
130+
#### [**Portal**](#tab/validate-portal)
131+
132+
1. In the search box at the top of the portal, enter **Virtual network**. Select **Virtual networks**.
133+
134+
1. Select **myVNet**.
135+
136+
1. In settings of **myVNet**, select **Subnets**.
137+
138+
1. Select your subnet.
139+
140+
1. In the **Edit subnet** pane, under **Network Policy for Private Endpoints**, confirm **Route Table** is selected.
141+
142+
1. In the virtual network overview page, select **JSON view** in the top right corner.
143+
144+
1. In the **Resource JSON** pane, select the latest API Version.
145+
146+
1. Validate that the virtual network property *privateEndpointVNetPolicies* is set to **Basic**.
147+
148+
1. Confirm that you can deploy more than 1,000 private endpoints in the respective virtual network.
149+
150+
#### [**PowerShell**](#tab/validate-PowerShell)
151+
152+
```Powershell
153+
154+
$vnetName = "myVirtualNetwork"
155+
$resourceGroupName = "myResourceGroup"
156+
$vnet = Get-AzVirtualNetwork /
157+
-ResourceGroupName $resourceGroupName /
158+
-Name $vnetName /
159+
$vnet.PrivateEndpointVNetPolicies
160+
161+
```
162+
163+
---
164+
165+
### Additional Considerations
166+
167+
* Upgrading or downgrading this feature triggers a platform update and results in a one-time connection reset of all long-running private endpoint connections. We recommend configuring High Scale Private Endpoints during a maintenance window.
168+
169+
* To downgrade from this feature, reduce the total private endpoint count in your virtual network to the limit before the feature was enabled.
170+
171+
* Monitoring Bytes In / Out will no longer be available on all high scale private endpoints.
172+
173+
* On-premises private endpoint traffic is now billed as an aggregate on your gateway virtual network. Previously, it was shown on the private endpoint resource in your billing cost center. This change doesn't affect your total bill.
174+
175+
### Limitations
176+
177+
| **Limit** | **Description** |
178+
|---|---|
179+
| Subscription must be enabled before enabling High Scale Private Endpoints. | Enabling Private Endpoint virtual network Policies before allow listing subscription feature flag requires a reconfiguration. |
180+
| Swift based virtual machines aren't supported. | Swift based virtual machines deployed within a High Scale Private Endpoint virtual network aren't supported with this feature. |
181+
| Feature currently available in select regions. | West Central US <br> UK South <br> East Asia <br> US East <br> US North |
182+
183+
## Next Steps
184+
185+
In this article, you learned how to enable High Scale Private Endpoints and the considerations that come with it. For more information on Azure Private Link, see the following articles:
186+
187+
* [Private Link Availability](/azure/private-link/availability)
188+
* [Private Link DNS Zone Values](/azure/private-link/private-endpoint-dns)
189+
* [Manage network policies for private endpoints](/azure/private-link/disable-private-endpoint-network-policy)
190+
* [What is a private endpoint?](/azure/private-link/private-endpoint-overview)

‎articles/private-link/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@
4848
href: create-private-link-service-template.md
4949
- name: Disable SNAT for traffic through NVA
5050
href: private-link-disable-snat.md
51+
- name: Increase Private Endpoint virtual network limits
52+
href: increase-private-endpoint-vnet-limits.md
5153
- name: Create a network security perimeter
5254
items:
5355
- name: Create a network security perimeter - Azure portal

0 commit comments

Comments
 (0)