You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> Private endpoint is available for Windows and Linux apps, containerized or not, hosted on these App Service plans: **Basic**, **Standard**, **PremiumV2**, **PremiumV3**, **IsolatedV2**, **Functions Premium** (sometimes referred to as the Elastic Premium plan).
18
+
> Private endpoints are available for Windows and Linux apps, containerized or not, hosted on these App Service plans: **Basic**, **Standard**, **PremiumV2**, **PremiumV3**, **IsolatedV2**, **Functions Premium** (sometimes called the *Elastic Premium* plan).
18
19
19
-
You can use private endpoint for your App Service apps to allow clients located in your private network to securely access the app over Azure Private Link. The private endpoint uses an IP address from your Azure virtual network address space. Network traffic between a client on your private network and the app traverses over the virtual network and a Private Link on the Microsoft backbone network, eliminating exposure from the public Internet.
20
+
You can use a private endpoint for your App Service apps. The private endpoint allows clients located in your private network to securely access the app over Azure Private Link. The private endpoint uses an IP address from your Azure virtual network address space. Network traffic between a client on your private network and the app traverses over the virtual network and a Private Link on the Microsoft backbone network. This configuration eliminates exposure from the public Internet.
20
21
21
-
Using private endpoint for your app enables you to:
22
+
Using a private endpoint for your app enables you to:
22
23
23
24
- Secure your app by configuring the private endpoint and disable public network access to eliminating public exposure.
24
25
- Securely connect to your app from on-premises networks that connect to the virtual network using a VPN or ExpressRoute private peering.
25
-
- Avoid any data exfiltration from your virtual network.
26
+
- Avoid any data exfiltration from your virtual network.
26
27
27
28
## Conceptual overview
28
29
29
30
A private endpoint is a special network interface (NIC) for your App Service app in a subnet in your virtual network.
30
31
When you create a private endpoint for your app, it provides secure connectivity between clients on your private network and your app. The private endpoint is assigned an IP Address from the IP address range of your virtual network.
31
32
The connection between the private endpoint and the app uses a secure [Private Link](../private-link/private-link-overview.md). Private endpoint is only used for incoming traffic to your app. Outgoing traffic doesn't use this private endpoint. You can inject outgoing traffic to your network in a different subnet through the [virtual network integration feature](./overview-vnet-integration.md).
32
33
33
-
Each slot of an app is configured separately. You can plug up to 100 private endpoints per slot. You can't share a private endpoint between slots. The subresource name of a slot is `sites-<slot-name>`.
34
+
Each slot of an app is configured separately. You can use up to 100 private endpoints per slot. You can't share a private endpoint between slots. The subresource name of a slot is `sites-<slot-name>`.
34
35
35
-
The subnet where you plug the private endpoint can have other resources in it, you don't need a dedicated empty subnet.
36
-
You can also deploy the private endpoint in a different region than your app.
36
+
The subnet where you plug the private endpoint can have other resources in it. You don't need a dedicated empty subnet.
37
+
You can also deploy the private endpoint in a different region than your app.
37
38
38
39
> [!NOTE]
39
40
> The virtual network integration feature can't use the same subnet as private endpoint.
40
41
41
42
From a security perspective:
42
43
43
-
- Private endpoint and public access can coexist on an app. For more information, see [overview of access restrictions](./overview-access-restrictions.md#how-it-works)
44
-
-When you enable private endpoints to your app, ensure that public network access is disabled to ensure isolation.
44
+
- Private endpoint and public access can coexist on an app. For more information, see [this overview of access restrictions](./overview-access-restrictions.md#how-it-works).
45
+
-To ensure isolation, when you enable private endpoints to your app, be sure that public network access is disabled.
45
46
- You can enable multiple private endpoints in others virtual networks and subnets, including virtual network in other regions.
46
47
- The access restrictions rules of your app aren't evaluated for traffic through the private endpoint.
47
48
- You can eliminate the data exfiltration risk from the virtual network by removing all Network Security Group (NSG) rules where destination is tag Internet or Azure services.
48
49
49
50
In the Web HTTP logs of your app, you find the client source IP. This feature is implemented using the TCP Proxy protocol, forwarding the client IP property up to the app. For more information, see [Getting connection Information using TCP Proxy v2](../private-link/private-link-service-overview.md#getting-connection-information-using-tcp-proxy-v2).
50
51
51
-
52
-
> [!div class="mx-imgBorder"]
53
-
> 
52
+
:::image type="content" source="./media/overview-private-endpoint/global-schema-web-app.png" alt-text="Diagram shows App Service app private endpoint global overview.":::
54
53
55
54
## DNS
56
55
57
-
When you use private endpoint for App Service apps, the requested URL must match the name of your app. By default `<app-name>.azurewebsites.net`. When you're using [unique default hostname](#dnl-note) your app name has the format `<app-name>-<random-hash>.<region>.azurewebsites.net`. In the examples below _mywebapp_ could also represent the full regionalized unique hostname.
58
-
59
-
By default, without private endpoint, the public name of your web app is a canonical name to the cluster. For example, the name resolution is:
56
+
When you use private endpoint for App Service apps, the requested URL must match the name of your app. By default, `<app-name>.azurewebsites.net`. When you use [unique default hostname](#dnl-note), your app name has the format `<app-name>-<random-hash>.<region>.azurewebsites.net`. In the following examples, *mywebapp* could also represent the full regionalized unique hostname.
|cloudservicename.cloudapp.net| A | 192.0.2.13 |<--This public IP isn't your private endpoint, you receive a 403 error|
77
75
78
76
You must set up a private DNS server or an Azure DNS private zone. For tests, you can modify the host entry of your test machine.
79
-
The DNS zone that you need to create is: **privatelink.azurewebsites.net**. Register the record for your app with a A record and the private endpoint IP.
77
+
The DNS zone that you need to create is: `privatelink.azurewebsites.net`. Register the record for your app with a A record and the private endpoint IP.
80
78
For example, the name resolution is:
81
79
82
-
|Name |Type |Value |Remark |
83
-
|-----|-----|------|-------|
84
-
|mywebapp.azurewebsites.net|CNAME|mywebapp.privatelink.azurewebsites.net|<--Azure creates this CNAME entry in Azure Public DNS to point the app address to the private endpoint address|
85
-
|mywebapp.privatelink.azurewebsites.net|A|10.10.10.8|<--You manage this entry in your DNS system to point to your private endpoint IP address|
80
+
|Name |Type |Value |Remark |
81
+
|:----|:----|:-----|:------|
82
+
|mywebapp.azurewebsites.net|CNAME|mywebapp.privatelink.azurewebsites.net|<--Azure creates this CNAME entry in Azure Public DNS to point the app address to the private endpoint address|
83
+
|mywebapp.privatelink.azurewebsites.net| A |10.10.10.8|<--You manage this entry in your DNS system to point to your private endpoint IP address|
86
84
87
-
After this DNS configuration, you can reach your app privately with the default name mywebapp.azurewebsites.net. You must use this name, because the default certificate is issued for *.azurewebsites.net.
85
+
After this DNS configuration, you can reach your app privately with the default name mywebapp.azurewebsites.net. You must use this name, because the default certificate is issued for `*.azurewebsites.net`.
88
86
87
+
If you need to use a custom DNS name, add the custom name in your app and you must validate the custom name like any custom name, using public DNS resolution. For more information, see [custom DNS validation](./app-service-web-tutorial-custom-domain.md).
89
88
90
-
If you need to use a custom DNS name, you must add the custom name in your app and you must validate the custom name like any custom name, using public DNS resolution.
91
-
For more information, see [custom DNS validation](./app-service-web-tutorial-custom-domain.md).
92
-
93
-
For the Kudu console, or Kudu REST API (deployment with Azure DevOps Services self-hosted agents for example) you must create two records pointing to the private endpoint IP in your Azure DNS private zone or your custom DNS server. The first is for your app and the second is for the SCM of your app.
89
+
For the Kudu console, or Kudu REST API (deployment with Azure DevOps Services self-hosted agents, for example) you must create two records pointing to the private endpoint IP in your Azure DNS private zone or your custom DNS server. The first is for your app and the second is for the SCM of your app.
94
90
95
91
| Name | Type | Value |
96
92
|-----|-----|-----|
97
-
| mywebapp.privatelink.azurewebsites.net | A | PrivateEndpointIP |
98
-
| mywebapp.scm.privatelink.azurewebsites.net | A | PrivateEndpointIP |
99
-
93
+
| mywebapp.privatelink.azurewebsites.net | A | PrivateEndpointIP |
94
+
| mywebapp.scm.privatelink.azurewebsites.net | A | PrivateEndpointIP |
100
95
101
96
## App Service Environment v3 special consideration
102
97
103
-
In order to enable private endpoint for apps hosted in an IsolatedV2 plan (App Service Environment v3), you have to enable the private endpoint support at the App Service Environment level.
98
+
In order to enable private endpoint for apps hosted in an IsolatedV2 plan (App Service Environment v3), enable the private endpoint support at the App Service Environment level.
104
99
You can activate the feature by the Azure portal in the App Service Environment configuration pane, or through the following CLI:
105
100
106
101
```azurecli-interactive
@@ -109,30 +104,29 @@ az appservice ase update --name myasename --allow-new-private-endpoint-connectio
109
104
110
105
## Specific requirements
111
106
112
-
If the virtual network is in a different subscription than the app, you must ensure that the subscription with the virtual network is registered for the `Microsoft.Web` resource provider. You can explicitly register the provider[by following this documentation](../azure-resource-manager/management/resource-providers-and-types.md#register-resource-provider) but you also automatically register the provider when you create the first web app in a subscription.
107
+
If the virtual network is in a different subscription than the app, ensure that the subscription with the virtual network is registered for the `Microsoft.Web` resource provider. To explicitly register the provider, see [Register resource provider](../azure-resource-manager/management/resource-providers-and-types.md#register-resource-provider). You automatically register the provider when you create the first web app in a subscription.
113
108
114
109
## Pricing
115
110
116
111
For pricing details, see [Azure Private Link pricing](https://azure.microsoft.com/pricing/details/private-link/).
117
112
118
-
119
113
## Limitations
120
114
121
-
* When you use Azure Function in Elastic Premium plan with private endpoint, to run or execute the function in Azure portal you must have direct network access or you receive an HTTP 403 error. In other words, your browser must be able to reach the private endpoint to execute the function from the Azure portal.
122
-
* You can connect up to 100 private endpoints to a particular app.
123
-
* Remote Debugging functionality isn't available through the private endpoint. The recommendation is to deploy the code to a slot and remote debug it there.
124
-
* FTP access is provided through the inbound public IP address. Private endpoint doesn't support FTP access to the app.
125
-
* IP-Based TLS isn't supported with private endpoints.
126
-
* Apps that you configure with private endpoints can't receive public traffic coming from subnets with `Microsoft.Web` service endpoint enabled and can't use [service endpoint-based access restriction rules](./overview-access-restrictions.md#access-restriction-rules-based-on-service-endpoints).
127
-
* Private endpoint naming must follow the rules defined for resources of type `Microsoft.Network/privateEndpoints`. Naming rules can be found [here](../azure-resource-manager/management/resource-name-rules.md#microsoftnetwork).
115
+
- When you use Azure Function in Elastic Premium plan with a private endpoint, to run the function in Azure portal, you must have direct network access. Otherwise, you receive an HTTP 403 error. Your browser must be able to reach the private endpoint to run the function from the Azure portal.
116
+
- You can connect up to 100 private endpoints to a particular app.
117
+
- Remote Debugging functionality isn't available through the private endpoint. We recommend that you deploy the code to a slot and remote debug it there.
118
+
- FTP access is provided through the inbound public IP address. A private endpoint doesn't support FTP access to the app.
119
+
- IP-Based TLS isn't supported with private endpoints.
120
+
- Apps that you configure with private endpoints can't receive public traffic that comes from subnets with `Microsoft.Web` service endpoint enabled and can't use [service endpoint-based access restriction rules](./overview-access-restrictions.md#access-restriction-rules-based-on-service-endpoints).
121
+
- Private endpoint naming must follow the rules defined for resources of type `Microsoft.Network/privateEndpoints`. For more information, see [Naming rules and restrictions](../azure-resource-manager/management/resource-name-rules.md#microsoftnetwork).
128
122
129
-
We're improving Azure Private Link feature and private endpoint regularly, check [this article](../private-link/private-endpoint-overview.md#limitations) for up-to-date information about limitations.
123
+
For up-to-date information about limitations, see [Limitations](../private-link/private-endpoint-overview.md#limitations).
130
124
131
-
## Next steps
125
+
## Related content
132
126
133
-
- To deploy private endpoint for your app through the portal, see [How to connect privately to an app with the Azure portal](../private-link/create-private-endpoint-portal.md)
134
-
- To deploy private endpoint for your app using Azure CLI, see [How to connect privately to an app with Azure CLI](../private-link/create-private-endpoint-cli.md)
135
-
- To deploy private endpoint for your app using PowerShell, see [How to connect privately to an app with PowerShell](../private-link/create-private-endpoint-powershell.md)
136
-
- To deploy private endpoint for your app using Azure template, see [How to connect privately to an app with Azure template](../private-link/create-private-endpoint-template.md)
137
-
-End-to-end example, how to connect a frontend app to a secured backend app with virtual network integration and private endpoint with ARM template, see this [quickstart](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.web/webapp-privateendpoint-vnet-injection)
138
-
-End-to-end example, how to connect a frontend app to a secured backend app with virtual network integration and private endpoint with terraform, see this [sample](./scripts/terraform-secure-backend-frontend.md)
127
+
- To deploy private endpoint for your app through the portal, see [How to connect privately to an app with the Azure portal](../private-link/create-private-endpoint-portal.md).
128
+
- To deploy private endpoint for your app using Azure CLI, see [How to connect privately to an app with Azure CLI](../private-link/create-private-endpoint-cli.md).
129
+
- To deploy private endpoint for your app using PowerShell, see [How to connect privately to an app with PowerShell](../private-link/create-private-endpoint-powershell.md).
130
+
- To deploy private endpoint for your app using Azure template, see [How to connect privately to an app with Azure template](../private-link/create-private-endpoint-template.md).
131
+
-To see an end-to-end example of how to connect a frontend app to a secured backend app with virtual network integration and private endpoint with ARM template, see this [quickstart](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.web/webapp-privateendpoint-vnet-injection).
132
+
-To see an end-to-end example of how to connect a frontend app to a secured backend app with virtual network integration and private endpoint with terraform, see this [sample](./scripts/terraform-secure-backend-frontend.md).
0 commit comments