Skip to content

Commit e38a850

Browse files
SNEWHSNEWH
committed
Service endpoint overview and FAQ is added to
private link family.
1 parent aefdc30 commit e38a850

File tree

3 files changed

+236
-1
lines changed

3 files changed

+236
-1
lines changed

‎articles/private-link/private-link-faq.yml

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,220 @@ sections:
4848
answer: |
4949
Yes. To utilize policies like User-Defined Routes and Network Security Groups, you need to enable Network policies for a subnet in a virtual network for the Private Endpoint. This setting affects all the private endpoints within the subnet.
5050
51+
- name: Service endpoint
52+
questions:
53+
- question: |
54+
What is the right sequence of operations to set up service endpoints to an Azure service?
55+
answer: |
56+
There are two steps to secure an Azure service resource through service endpoints:
57+
58+
1. Turn on service endpoints for the Azure service.
59+
1. Set up virtual network access control lists (ACLs) on the Azure service.
60+
61+
The first step is a network-side operation, and the second step is a service resource-side operation. The same administrator or different administrators can perform the steps, based on the Azure role-based access control (RBAC) permissions granted to the administrator role.
62+
63+
We recommend that you turn on service endpoints for your virtual network before you set up virtual network ACLs on the Azure service side. To set up virtual network service endpoints, you must perform the steps in the preceding sequence.
64+
65+
>[!NOTE]
66+
> You must complete both of the preceding operations before you can limit the Azure service access to the allowed virtual network and subnet. Only turning on service endpoints for the Azure service on the network side does not give you the limited access. You must also set up virtual network ACLs on the Azure service side.
67+
68+
Certain services (such as Azure SQL and Azure Cosmos DB) allow exceptions to the preceding sequence through the `IgnoreMissingVnetServiceEndpoint` flag. After you set the flag to `True`, you can set up virtual network ACLs on the Azure service side before turning on the service endpoints on the network side. Azure services provide this flag to help customers in cases where the specific IP firewalls are configured on Azure services.
69+
70+
Turning on the service endpoints on the network side can lead to a connectivity drop, because the source IP changes from a public IPv4 address to a private address. Setting up virtual network ACLs on the Azure service side before turning on service endpoints on the network side can help avoid a connectivity drop.
71+
72+
>[!NOTE]
73+
> If you enable Service Endpoint on certain services like "Microsoft.AzureActiveDirectory" you can see IPV6 address connections on Sign-In Logs. Microsoft use an internal IPV6 private range for this type of connection.
74+
75+
- question: |
76+
Do all Azure services reside in the Azure virtual network that the customer provides? How does a virtual network service endpoint work with Azure services?
77+
answer: |
78+
Not all Azure services reside in the customer's virtual network. Most Azure data services (such as Azure Storage, Azure SQL, and Azure Cosmos DB) are multitenant services that can be accessed over public IP addresses. For more information, see [Deploy dedicated Azure services into virtual networks](virtual-network-for-azure-services.md).
79+
80+
When you turn on virtual network service endpoints on the network side, and set up appropriate virtual network ACLs on the Azure service side, access to an Azure service is restricted to an allowed virtual network and subnet.
81+
82+
- question: |
83+
How do virtual network service endpoints provide security?
84+
answer: |
85+
Virtual network service endpoints limit the Azure service's access to the allowed virtual network and subnet. In this way, they provide network-level security and isolation of the Azure service traffic.
86+
87+
All traffic that uses virtual network service endpoints flows over the Microsoft backbone to provide another layer of isolation from the public internet. Customers can also choose to fully remove public internet access to the Azure service resources and allow traffic only from their virtual network through a combination of IP firewall and virtual network ACLs. Removing internet access helps protect the Azure service resources from unauthorized access.
88+
89+
- question: |
90+
What does the virtual network service endpoint protect - virtual network resources or Azure service resources?
91+
answer: |
92+
Virtual network service endpoints help protect Azure service resources. Virtual network resources are protected through network security groups.
93+
94+
- question: |
95+
Is there any cost for using virtual network service endpoints?
96+
answer: |
97+
No. There's no additional cost for using virtual network service endpoints.
98+
99+
- question: |
100+
Can I turn on virtual network service endpoints and set up virtual network ACLs if the virtual network and the Azure service resources belong to different subscriptions?
101+
answer: |
102+
Yes, it's possible. Virtual networks and Azure service resources can be in the same subscription or in different subscriptions. The only requirement is that both the virtual network and the Azure service resources must be under the same Microsoft Entra tenant.
103+
104+
- question: |
105+
Can I turn on virtual network service endpoints and set up virtual network ACLs if the virtual network and the Azure service resources belong to different Microsoft Entra tenants?
106+
answer: |
107+
Yes, it's possible when you're using service endpoints for Azure Storage and Azure Key Vault. For other services, virtual network service endpoints and virtual network ACLs are not supported across Microsoft Entra tenants.
108+
109+
- question: |
110+
Can an on-premises device's IP address that's connected through an Azure virtual network gateway (VPN) or ExpressRoute gateway access Azure PaaS services over virtual network service endpoints?
111+
answer: |
112+
By default, Azure service resources secured to virtual networks are not reachable from on-premises networks. If you want to allow traffic from on-premises, you must also allow public (typically, NAT) IP addresses from on-premises or ExpressRoute. You can add these IP addresses through the IP firewall configuration for the Azure service resources.
113+
114+
Alternatively, you can implement [private endpoints](/azure/private-link/private-endpoint-overview) for supported services.
115+
116+
- question: |
117+
Can I use virtual network service endpoints to secure Azure services to multiple subnets within a virtual network or across multiple virtual networks?
118+
answer: |
119+
To secure Azure services to multiple subnets within a virtual network or across multiple virtual networks, enable service endpoints on the network side on each of the subnets independently. Then, secure Azure service resources to all of the subnets by setting up appropriate virtual network ACLs on the Azure service side.
120+
121+
- question: |
122+
How can I filter outbound traffic from a virtual network to Azure services and still use service endpoints?
123+
answer: |
124+
If you want to inspect or filter the traffic destined to an Azure service from a virtual network, you can deploy a network virtual appliance within the virtual network. You can then apply service endpoints to the subnet where the network virtual appliance is deployed and secure Azure service resources only to this subnet through virtual network ACLs.
125+
126+
This scenario might also be helpful if you want to restrict Azure service access from your virtual network only to specific Azure resources by using network virtual appliance filtering. For more information, see [Deploy highly available NVAs](/azure/architecture/reference-architectures/dmz/nva-ha).
127+
128+
- question: |
129+
What happens when someone accesses an Azure service account that has a virtual network ACL enabled from outside the virtual network?
130+
answer: |
131+
The service returns an HTTP 403 or HTTP 404 error.
132+
133+
- question: |
134+
Are subnets of a virtual network created in different regions allowed to access an Azure service account in another region?
135+
answer: |
136+
Yes. For most of the Azure services, virtual networks created in different regions can access Azure services in another region through the virtual network service endpoints. For example, if an Azure Cosmos DB account is in the West US or East US region, and virtual networks are in multiple regions, the virtual networks can access Azure Cosmos DB.
137+
138+
Azure SQL is an exception and is regional in nature. Both the virtual network and the Azure service need to be in the same region.
139+
140+
- question: |
141+
Can an Azure service have both a virtual network ACL and an IP firewall?
142+
answer: |
143+
Yes. A virtual network ACL and an IP firewall can coexist. The features complement each other to help ensure isolation and security.
144+
145+
- question: |
146+
What happens if you delete a virtual network or subnet that has service endpoints turned on for Azure services?
147+
answer: |
148+
Deletion of virtual networks and deletion of subnets are independent operations. They're supported even when you turn on service endpoints for Azure services.
149+
150+
If you set up virtual network ACLs for Azure services, the ACL information associated with those Azure services is disabled when you delete a virtual network or subnet that has virtual network service endpoints turned on.
151+
152+
- question: |
153+
What happens if I delete an Azure service account that has a virtual network service endpoint turned on?
154+
answer: |
155+
The deletion of an Azure service account is an independent operation. It's supported even if you turned on the service endpoint on the network side and set up virtual network ACLs on the Azure service side.
156+
157+
- question: |
158+
What happens to the source IP address of a resource (like a VM in a subnet) that has virtual network service endpoints turned on?
159+
answer: |
160+
When you turn on virtual network service endpoints, the source IP addresses of the resources in your virtual network's subnet switch from using public IPv4 addresses to using the Azure virtual network's private IP addresses for traffic to Azure services. This switch can cause specific IP firewalls that are set to a public IPv4 address earlier on the Azure services to fail.
161+
162+
- question: |
163+
Does the service endpoint route always take precedence?
164+
answer: |
165+
Service endpoints add a system route that takes precedence over Border Gateway Protocol (BGP) routes and provides optimum routing for the service endpoint traffic. Service endpoints always take service traffic directly from your virtual network to the service on the Microsoft Azure backbone network.
166+
167+
For more information about how Azure selects a route, see [Virtual network traffic routing](virtual-networks-udr-overview.md).
168+
169+
- question: |
170+
Do service endpoints work with ICMP?
171+
answer: |
172+
No. ICMP traffic that's sourced from a subnet with service endpoints enabled won't take the service tunnel path to the desired endpoint. Service endpoints handle only TCP traffic. If you want to test latency or connectivity to an endpoint via service endpoints, tools like ping and tracert won't show the true path that the resources within the subnet will take.
173+
174+
- question: |
175+
How do NSGs on a subnet work with service endpoints?
176+
answer: |
177+
To reach the Azure service, NSGs need to allow outbound connectivity. If your NSGs are opened to all internet outbound traffic, the service endpoint traffic should work. You can also limit the outbound traffic to only service IP addresses by using the service tags.
178+
179+
- question: |
180+
What permissions do I need to set up service endpoints?
181+
answer: |
182+
You can configure service endpoints on a virtual network independently if you have write access to that network.
183+
184+
To secure Azure service resources to a virtual network, you must have **Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action** permission for the subnets that you're adding. This permission is included in the built-in service administrator role by default and can be modified through the creation of custom roles.
185+
186+
For more information about built-in roles and assigning specific permissions to custom roles, see [Azure custom roles](../role-based-access-control/custom-roles.md?toc=%2fazure%2fvirtual-network%2ftoc.json).
187+
188+
- question: |
189+
Can I filter virtual network traffic to Azure services over service endpoints?
190+
answer: |
191+
You can use virtual network service endpoint policies to filter virtual network traffic to Azure services, allowing only specific Azure service resources over the service endpoints. Endpoint policies provide granular access control from the virtual network traffic to the Azure services.
192+
193+
To learn more, see [Virtual network service endpoint policies for Azure Storage](virtual-network-service-endpoint-policies-overview.md).
194+
195+
- question: |
196+
Does Microsoft Entra ID support virtual network service endpoints?
197+
answer: |
198+
Microsoft Entra ID doesn't support service endpoints natively. For a complete list of Azure services that support virtual network service endpoints, see [Virtual network service endpoints](./virtual-network-service-endpoints-overview.md).
199+
200+
In that list, the *Microsoft.AzureActiveDirectory* tag listed under services that support service endpoints is used for supporting service endpoints to Azure Data Lake Storage Gen1. [Virtual network integration for Data Lake Storage Gen1](../data-lake-store/data-lake-store-network-security.md?toc=%2fazure%2fvirtual-network%2ftoc.json) makes use of the virtual network service endpoint security between your virtual network and Microsoft Entra ID to generate additional security claims in the access token. These claims are then used to authenticate your virtual network to your Data Lake Storage Gen1 account and allow access.
201+
202+
- question: |
203+
Are there any limits on how many service endpoints I can set up from my virtual network?
204+
answer: |
205+
There is no limit on the total number of service endpoints in a virtual network. For an Azure service resource (such as an Azure Storage account), services might enforce limits on the number of subnets that you use for securing the resource. The following table shows some example limits:
206+
207+
| Azure service | Limits on virtual network rules |
208+
|---|---|
209+
| Azure Storage | 200 |
210+
| Azure SQL | 128 |
211+
| Azure Synapse Analytics | 128 |
212+
| Azure Key Vault | 200 |
213+
| Azure Cosmos DB | 64 |
214+
| Azure Event Hubs | 128 |
215+
| Azure Service Bus | 128 |
216+
217+
>[!NOTE]
218+
> The limits are subject to change at the discretion of the Azure services. Refer to the respective service documentation for details.
219+
220+
- question: |
221+
How do NSGs on a subnet work with service endpoints?
222+
answer: |
223+
To reach the Azure service, NSGs need to allow outbound connectivity. If your NSGs are opened to all internet outbound traffic, the service endpoint traffic should work. You can also limit the outbound traffic to only service IP addresses by using the service tags.
224+
225+
- question: |
226+
What permissions do I need to set up service endpoints?
227+
answer: |
228+
You can configure service endpoints on a virtual network independently if you have write access to that network.
229+
230+
To secure Azure service resources to a virtual network, you must have **Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action** permission for the subnets that you're adding. This permission is included in the built-in service administrator role by default and can be modified through the creation of custom roles.
231+
232+
For more information about built-in roles and assigning specific permissions to custom roles, see [Azure custom roles](../role-based-access-control/custom-roles.md?toc=%2fazure%2fvirtual-network%2ftoc.json).
233+
234+
- question: |
235+
Can I filter virtual network traffic to Azure services over service endpoints?
236+
answer: |
237+
You can use virtual network service endpoint policies to filter virtual network traffic to Azure services, allowing only specific Azure service resources over the service endpoints. Endpoint policies provide granular access control from the virtual network traffic to the Azure services.
238+
239+
To learn more, see [Virtual network service endpoint policies for Azure Storage](virtual-network-service-endpoint-policies-overview.md).
240+
241+
- question: |
242+
Does Microsoft Entra ID support virtual network service endpoints?
243+
answer: |
244+
Microsoft Entra ID doesn't support service endpoints natively. For a complete list of Azure services that support virtual network service endpoints, see [Virtual network service endpoints](./virtual-network-service-endpoints-overview.md).
245+
246+
In that list, the *Microsoft.AzureActiveDirectory* tag listed under services that support service endpoints is used for supporting service endpoints to Azure Data Lake Storage Gen1. [Virtual network integration for Data Lake Storage Gen1](../data-lake-store/data-lake-store-network-security.md?toc=%2fazure%2fvirtual-network%2ftoc.json) makes use of the virtual network service endpoint security between your virtual network and Microsoft Entra ID to generate additional security claims in the access token. These claims are then used to authenticate your virtual network to your Data Lake Storage Gen1 account and allow access.
247+
248+
- question: |
249+
Are there any limits on how many service endpoints I can set up from my virtual network?
250+
answer: |
251+
There is no limit on the total number of service endpoints in a virtual network. For an Azure service resource (such as an Azure Storage account), services might enforce limits on the number of subnets that you use for securing the resource. The following table shows some example limits:
252+
253+
| Azure service | Limits on virtual network rules |
254+
|---|---|
255+
| Azure Storage | 200 |
256+
| Azure SQL | 128 |
257+
| Azure Synapse Analytics | 128 |
258+
| Azure Key Vault | 200 |
259+
| Azure Cosmos DB | 64 |
260+
| Azure Event Hubs | 128 |
261+
| Azure Service Bus | 128 |
262+
263+
>[!NOTE]
264+
> The limits are subject to change at the discretion of the Azure services. Refer to the respective service documentation for details.
51265
52266
- name: Private Endpoint
53267
questions:

‎articles/private-link/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88
href: private-endpoint-overview.md
99
- name: Private Link service
1010
href: private-link-service-overview.md
11+
- name: Service endpoints
12+
href: Service-endpoints-overview.md
1113
- name: What is a network security perimeter?
1214
href: network-security-perimeter-concepts.md
1315
- name: Availability

0 commit comments

Comments
 (0)