Skip to content

Commit 9d30d34

Browse files
Jak-MSJak-MS
authored
Merge pull request #100783 from HeidiSteen/heidist-vnet
Azure Cognitive Search: private endpoint
2 parents 416a6d1 + 1677b1a commit 9d30d34

File tree

2 files changed

+92
-88
lines changed

2 files changed

+92
-88
lines changed

‎articles/search/service-create-private-endpoint.md

Lines changed: 86 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,50 @@
11
---
2-
title: Create a Private Endpoint for secure connections
2+
title: Create a Private Endpoint for a secure connection
33
titleSuffix: Azure Cognitive Search
4-
description: Currently in preview, you can restrict access to a search service endpoint using Private Endpoint and a secure VNet connection.
4+
description: Set up a private endpoint in a virtual network for a secure connection to an Azure Cognitive Search service
55

66
manager: nitinme
77
author: mrcarter8
88
ms.author: mcarter
99
ms.service: cognitive-search
1010
ms.topic: conceptual
11-
ms.date: 01/09/2020
11+
ms.date: 01/13/2020
1212
---
1313

14-
# Restrict access to Azure Cognitive Search using Private Endpoint and a virtual network connection.
14+
# Create a Private Endpoint for a secure connection to Azure Cognitive Search (Preview)
1515

16-
> [!IMPORTANT]
17-
> Support for Private Endpoint is currently available as a limited-access preview. This preview is only available for search services on the **Basic tier**.
18-
> This preview version is provided without a service level agreement, and it's not recommended for production workloads. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
19-
> The [REST API version 2019-10-01-Preview](search-api-preview.md) provides this feature. There is no portal or .NET SDK support at this time.
16+
[Private Endpoints](../private-link/private-endpoint-overview.md) for Azure Cognitive Search allow a client on a virtual network to securely access data in a search index over a [Private Link](../private-link/private-link-overview.md). The private endpoint uses an IP address from the [virtual network address space](../virtual-network/virtual-network-ip-addresses-overview-arm.md#private-ip-addresses) for your search service. Network traffic between the client and the search service traverses over the virtual network and a private link on the Microsoft backbone network, eliminating exposure from the public internet. For a list of other PaaS services that support Private Link, check the [availability section](../private-link/private-link-overview.md#availability) in the product documentation.
2017

21-
In this article, learn how to create a new search service that is accessible over secure connections, with no access from public IP addresses. Client connections are allowed from Azure virtual machines deployed in the same virtual network as the service.
18+
> [!Important]
19+
> Private Endpoint support for Azure Cognitive Search is available as a limited-access preview and not currently intended for production use. Please fill out and submit the [access request form](https://aka.ms/SearchPrivateLinkRequestAccess) if you would like to access the preview. The form requests information about you, your company, and general application architecture. Once we review your request, you'll receive a confirmation email with additional instructions.
20+
>
21+
> Once you are granted access to the preview, you'll be able to configure Private Endpoints for your service using the Azure portal and REST API version [2019-10-06-Preview](search-api-preview.md).
22+
>
2223
23-
## About Private Endpoint support
24+
Private endpoints for your search service enables you to:
2425

25-
[Private Endpoints](../private-link/private-endpoint-overview.md) for Azure Cognitive Search allow a client on a virtual network to securely access data over a [Private Link](../private-link/private-link-overview.md). The private endpoint uses an IP address from the [virtual network address space](../virtual-network/virtual-network-ip-addresses-overview-arm.md#private-ip-addresses) for your search service. Network traffic between the client and the search service traverses over the virtual network and a private link on the Microsoft backbone network, eliminating exposure to the public internet. For a list of PaaS services that support Private Link, check the [availability section](../private-link/private-link-overview.md#availability) in the product documentation.
26-
27-
A private endpoint for your search service enables you to:
28-
29-
+ Block all connections on the public endpoint for your search service.
30-
+ Increase security for the virtual network by enabling you to block exfiltration of data from the virtual network.
31-
+ Securely connect to your search service from on-premises networks that connect to the virtual network using [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md) or [ExpressRoutes](../expressroute/expressroute-locations.md) with private-peering.
26+
- Block all connections on the public endpoint for your search service.
27+
- Increase security for the virtual network, by enabling you to block exfiltration of data from the virtual network.
28+
- Securely connect to your search service from on-premises networks that connect to the virtual network using [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md) or [ExpressRoutes](../expressroute/expressroute-locations.md) with private-peering.
3229

3330
> [!NOTE]
34-
> When the service endpoint is private, some portal features are disabled. You'll be able to view and manage service level information, but portal access to index data and the various components in the service, such as the index, indexer, and skillset definitions, is restricted for security reasons.
31+
> There are currently some limitations in the preview that you should be aware of:
32+
> * Available only for search services on the **Basic** tier.
33+
> * Available in the West US 2, West Central US, East US, South Central US, Australia East, and Australia Southeast regions.
34+
> * When the service endpoint is private, some portal features are disabled. You'll be able to view and manage service level information, but portal access to index data and the various components in the service, such as the index, indexer, and skillset definitions, is restricted for security reasons.
35+
> * When the service endpoint is private, you must use the search API to upload documents to the index.
36+
> * You must use the following link to see the private endpoint support option in the Azure portal: https://portal.azure.com/?feature.enablePrivateEndpoints=true
3537
36-
## Request access
38+
In this article, you'll learn how to use the portal to create a new Azure Cognitive Search service instance that can't be accessed via a public IP address, configure an Azure virtual machine in the same virtual network, and use it to access the search service via a private endpoint.
3739

38-
Click [request access](https://aka.ms/SearchPrivateLinkRequestAccess) to sign up for this preview feature. The form requests information about you, your company, and general network topology. Once we review your request, you'll receive a confirmation email with additional instructions.
3940

4041
## Create a VM
4142
In this section, you will create a virtual network and subnet to host the VM that will be used to access your search service's private endpoint.
4243

43-
### Set up the virtual network
44-
1. Sign in to the [Azure portal](https://portal.azure.com).
45-
1. On the top left, select **Create a resource** > **Networking** > **Virtual network**.
44+
### Create the virtual network
45+
46+
1. From the Azure portal home tab, select **Create a resource** > **Networking** > **Virtual network**.
47+
4648
1. In **Create virtual network**, enter or select this information:
4749

4850
| Setting | Value |
@@ -59,59 +61,11 @@ In this section, you will create a virtual network and subnet to host the VM tha
5961
1. Leave the rest as default and select **Create**.
6062

6163

62-
### Create a virtual machine
63-
64-
1. On the top left of main portal page, select **Create a resource** > **Compute** > **Virtual machine**.
65-
66-
1. In **Create a virtual machine - Basics**, enter or select this information:
67-
68-
| Setting | Value |
69-
| ------- | ----- |
70-
| **PROJECT DETAILS** | |
71-
| Subscription | Select your subscription. |
72-
| Resource group | Select **myResourceGroup**. You created this in the previous section. |
73-
| **INSTANCE DETAILS** | |
74-
| Virtual machine name | Enter *myVm*. |
75-
| Region | Select **West US** or whatever region you are using. |
76-
| Availability options | Leave the default **No infrastructure redundancy required**. |
77-
| Image | Select **Windows Server 2019 Datacenter**. |
78-
| Size | Leave the default **Standard DS1 v2**. |
79-
| **ADMINISTRATOR ACCOUNT** | |
80-
| Username | Enter a username of your choosing. |
81-
| Password | Enter a password of your choosing. The password must be at least 12 characters long and meet the [defined complexity requirements](../virtual-machines/windows/faq.md?toc=%2fazure%2fvirtual-network%2ftoc.json#what-are-the-password-requirements-when-creating-a-vm).|
82-
| Confirm Password | Reenter password. |
83-
| **INBOUND PORT RULES** | |
84-
| Public inbound ports | Leave the default **None**. |
85-
| **SAVE MONEY** | |
86-
| Already have a Windows license? | Leave the default **No**. |
87-
|||
88-
89-
1. Select **Next: Disks**.
90-
91-
1. In **Create a virtual machine - Disks**, leave the defaults and select **Next: Networking**.
92-
93-
1. In **Create a virtual machine - Networking**, select this information:
94-
95-
| Setting | Value |
96-
| ------- | ----- |
97-
| Virtual network | Leave the default **MyVirtualNetwork**. |
98-
| Address space | Leave the default **10.1.0.0/24**.|
99-
| Subnet | Leave the default **mySubnet (10.1.0.0/24)**.|
100-
| Public IP | Leave the default **(new) myVm-ip**. |
101-
| Public inbound ports | Select **Allow selected ports**. |
102-
| Select inbound ports | Select **HTTP** and **RDP**.|
103-
||
104-
105-
1. Select **Review + create**. You're taken to the **Review + create** page where Azure validates your configuration.
106-
107-
1. When you see the **Validation passed** message, select **Create**.
108-
109-
11064
## Create your search service with a private endpoint
11165

11266
In this section, you will create a new Azure Cognitive Search service with a Private Endpoint.
11367

114-
1. On the top left of main portal page, select **Create a resource** > **Web** > **Azure Cognitive Search**.
68+
1. On the upper-left side of the screen in the Azure portal, select **Create a resource** > **Web** > **Azure Cognitive Search**.
11569

11670
1. In **New Search Service - Basics**, enter or select this information:
11771

@@ -156,11 +110,62 @@ In this section, you will create a new Azure Cognitive Search service with a Pri
156110
1. Select **Review + create**. You're taken to the **Review + create** page where Azure validates your configuration.
157111

158112
1. When you see the **Validation passed** message, select **Create**.
159-
1. Once the service is created, browse to the resource that you just created.
113+
114+
1. Once provisioning of your new service is complete, browse to the resource that you just created.
115+
160116
1. Select **Keys** from the left content menu.
161-
1. Copy the **Primary admin key** for use in the next step.
162117

163-
118+
1. Copy the **Primary admin key** for later.
119+
120+
### Create a virtual machine
121+
122+
1. On the upper-left side of the screen in the Azure portal, select **Create a resource** > **Compute** > **Virtual machine**.
123+
124+
1. In **Create a virtual machine - Basics**, enter or select this information:
125+
126+
| Setting | Value |
127+
| ------- | ----- |
128+
| **PROJECT DETAILS** | |
129+
| Subscription | Select your subscription. |
130+
| Resource group | Select **myResourceGroup**. You created this in the previous section. |
131+
| **INSTANCE DETAILS** | |
132+
| Virtual machine name | Enter *myVm*. |
133+
| Region | Select **West US** or whatever region you are using. |
134+
| Availability options | Leave the default **No infrastructure redundancy required**. |
135+
| Image | Select **Windows Server 2019 Datacenter**. |
136+
| Size | Leave the default **Standard DS1 v2**. |
137+
| **ADMINISTRATOR ACCOUNT** | |
138+
| Username | Enter a username of your choosing. |
139+
| Password | Enter a password of your choosing. The password must be at least 12 characters long and meet the [defined complexity requirements](../virtual-machines/windows/faq.md?toc=%2fazure%2fvirtual-network%2ftoc.json#what-are-the-password-requirements-when-creating-a-vm).|
140+
| Confirm Password | Reenter password. |
141+
| **INBOUND PORT RULES** | |
142+
| Public inbound ports | Leave the default **Allow selected ports**. |
143+
| Select inbound ports | Leave the default **RDP (3389)**. |
144+
| **SAVE MONEY** | |
145+
| Already have a Windows license? | Leave the default **No**. |
146+
|||
147+
148+
1. Select **Next: Disks**.
149+
150+
1. In **Create a virtual machine - Disks**, leave the defaults and select **Next: Networking**.
151+
152+
1. In **Create a virtual machine - Networking**, select this information:
153+
154+
| Setting | Value |
155+
| ------- | ----- |
156+
| Virtual network | Leave the default **MyVirtualNetwork**. |
157+
| Address space | Leave the default **10.1.0.0/24**.|
158+
| Subnet | Leave the default **mySubnet (10.1.0.0/24)**.|
159+
| Public IP | Leave the default **(new) myVm-ip**. |
160+
| Public inbound ports | Select **Allow selected ports**. |
161+
| Select inbound ports | Select **HTTP** and **RDP**.|
162+
||
163+
164+
1. Select **Review + create**. You're taken to the **Review + create** page where Azure validates your configuration.
165+
166+
1. When you see the **Validation passed** message, select **Create**.
167+
168+
164169
## Connect to a VM from the internet
165170

166171
Connect to the VM *myVm* from the internet as follows:
@@ -182,14 +187,14 @@ Connect to the VM *myVm* from the internet as follows:
182187
183188
1. Select **OK**.
184189

185-
1. You may receive a certificate warning when signing in. If you receive a certificate warning, select **Yes** or **Continue**.
190+
1. You may receive a certificate warning during the sign-in process. If you receive a certificate warning, select **Yes** or **Continue**.
186191

187192
1. Once the VM desktop appears, minimize it to go back to your local desktop.
188193

189194

190195
## Access the search service privately from the VM
191196

192-
In this section, you will verify private network access to the search service and connect privately to the storage account using the Private Endpoint.
197+
In this section, you will verify private network access to the search service and connect privately to the using the Private Endpoint.
193198

194199
1. In the Remote Desktop of *myVM*, open PowerShell.
195200

@@ -204,25 +209,20 @@ In this section, you will verify private network access to the search service an
204209
Address: 10.0.0.5
205210
Aliases: [search service name].search.windows.net
206211
```
207-
1. Follow this [Quickstart](search-get-started-postman.md) from the VM to create a new search index in your service in Postman using the REST API.
212+
1. Follow this [Quickstart](search-get-started-postman.md) from the VM to create a new search index in your service in Postman using the REST API. Use the key you copied in a previous step to authenticate to the service.
208213
209214
1. Try several of these same requests in Postman on your local workstation.
210215
211216
1. If you are able to complete the Quickstart from the VM, but receive an error that the remote server does not exist on your local workstation, you have successfully configured a private endpoint for your search service.
212217
213218
1. Close the remote desktop connection to *myVM*.
214219
215-
## Clean up resources
216-
217-
When you're done using the Private Endpoint, search service account, and the VM, delete the resource group and all of the resources it contains:
218220
221+
## Clean up resources
222+
When you're done using the Private Endpoint, search service, and the VM, delete the resource group and all of the resources it contains:
219223
1. Enter *myResourceGroup* in the **Search** box at the top of the portal and select *myResourceGroup* from the search results.
220224
1. Select **Delete resource group**.
221225
1. Enter *myResourceGroup* for **TYPE THE RESOURCE GROUP NAME** and select **Delete**.
222226
223227
## Next steps
224-
225-
In this article, you created a VM on a virtual network and a search service with a Private Endpoint. You connected to the VM from the internet and securely communicated to the search service using Private Link.
226-
227-
> [!div class="nextstepaction"]
228-
> [What is Azure Private Endpoint?](../private-link/private-endpoint-overview.md).
228+
In this article, you created a VM on a virtual network and a search service with a Private Endpoint. You connected to the VM from the internet and securely communicated to the search service using Private Link. To learn more about Private Endpoint, see [What is Azure Private Endpoint?](../private-link/private-endpoint-overview.md).

‎articles/search/whats-new.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ author: HeidiSteen
88
ms.author: heidist
99
ms.service: cognitive-search
1010
ms.topic: conceptual
11-
ms.date: 01/07/2020
11+
ms.date: 01/13/2020
1212
---
1313
# What's new in Azure Cognitive Search
1414

@@ -28,7 +28,11 @@ API versions, Nuget packages, namespaces, and endpoints are unchanged. Your exis
2828

2929
+ [Customer-managed encryption keys](search-security-manage-encryption-keys.md) is now generally available. If you are using REST, you can access the feature using `api-version=2019-05-06`. For managed code, the correct package is still [.NET SDK version 8.0-preview](search-dotnet-sdk-migration-version-9.md) even though the feature is out of preview.
3030

31-
+ *Restricted IP access and private endpoint (preview)* on a search service endpoint is now available in **api-version=2019-10-01-Preview**. You can set up a secure endpoint using the new **IpRule** and **NetworkRuleSet** properties in the [Create or Update](https://docs.microsoft.com/rest/api/searchmanagement/services/createorupdate) Management REST API. For more information about API versions and regional availability, see [How to use the Management REST API](https://docs.microsoft.com/rest/api/searchmanagement/search-howto-management-rest-api).
31+
+ Private access to a search service is available through two mechanisms:
32+
33+
+ You can restrict access to specific IP addresses by using the Management REST API `api-version=2019-10-01-Preview` to create the service. The preview API has new **IpRule** and **NetworkRuleSet** properties in [CreateOrUpdate API](https://docs.microsoft.com/rest/api/searchmanagement/services/createorupdate). This preview feature is available in selected regions. For more information, see [How to use the Management REST API](https://docs.microsoft.com/rest/api/searchmanagement/search-howto-management-rest-api).
34+
35+
+ Currently available through a limited-access preview, you can provision an Azure Search service that supports Azure Private Endpoint for connections from clients on the same virtual network. For more information, see [Create a Private Endpoint for a secure connection](service-create-private-endpoint.md).
3236

3337
### December 2019
3438

0 commit comments

Comments
 (0)