Using Private Endpoints for App Service apps

  • Article

Note

Starting June 1, 2024, all newly created App Service apps will have the option to generate a unique default hostname using the naming convention <app-name>-<random-hash>.<region>.chinacloudsites.cn. Existing app names will remain unchanged.

Example: myapp-ds27dh7271aah175.westus-01.chinacloudsites.cn

Important

Private endpoint is available for Windows and Linux apps, containerized or not, hosted on these App Service plans : Basic, Standard, PremiumV2, IsolatedV2, Functions Premium (sometimes referred to as the Elastic Premium plan).

You can use private endpoint for your App Service apps to allow clients located in your private network to securely access the app over Azure Private Link. The private endpoint uses an IP address from your Azure virtual network address space. Network traffic between a client on your private network and the app traverses over the virtual network and a Private Link on the Microsoft backbone network, eliminating exposure from the public Internet.

Using private endpoint for your app enables you to:

  • Secure your app by configuring the private endpoint and disable public network access to eliminating public exposure.
  • Securely connect to your app from on-premises networks that connect to the virtual network using a VPN or ExpressRoute private peering.
  • Avoid any data exfiltration from your virtual network.

Conceptual overview

A private endpoint is a special network interface (NIC) for your App Service app in a subnet in your virtual network. When you create a private endpoint for your app, it provides secure connectivity between clients on your private network and your app. The private endpoint is assigned an IP Address from the IP address range of your virtual network. The connection between the private endpoint and the app uses a secure Private Link. Private endpoint is only used for incoming traffic to your app. Outgoing traffic doesn't use this private endpoint. You can inject outgoing traffic to your network in a different subnet through the virtual network integration feature.

Each slot of an app is configured separately. You can plug up to 100 private endpoints per slot. You can't share a private endpoint between slots. The subresource name of a slot is sites-<slot-name>.

The subnet where you plug the private endpoint can have other resources in it, you don't need a dedicated empty subnet. You can also deploy the private endpoint in a different region than your app.

Note

The virtual network integration feature cannot use the same subnet as private endpoint, this is a limitation of the virtual network integration feature.

From a security perspective:

  • Private endpoint and public access can coexist on an app. For more information, see overview of access restrictions
  • When you enable private endpoints to your app, ensure that public network access is disabled to ensure isolation.
  • You can enable multiple private endpoints in others virtual networks and subnets, including virtual network in other regions.
  • The access restrictions rules of your app aren't evaluated for traffic through the private endpoint.
  • You can eliminate the data exfiltration risk from the virtual network by removing all Network Security Group (NSG) rules where destination is tag Internet or Azure services.

In the Web HTTP logs of your app, you find the client source IP. This feature is implemented using the TCP Proxy protocol, forwarding the client IP property up to the app. For more information, see Getting connection Information using TCP Proxy v2.

App Service app private endpoint global overview

DNS

When you use private endpoint for App Service apps, the requested URL must match the name of your app. By default <app-name>.chinacloudsites.cn. When you're using unique default hostname your app name has the format <app-name>-<random-hash>.<region>.chinacloudsites.cn. In the examples below mywebapp could also represent the full regionalized unique hostname.

By default, without private endpoint, the public name of your web app is a canonical name to the cluster. For example, the name resolution is:

Name Type Value
mywebapp.chinacloudsites.cn CNAME clustername.azurewebsites.chinacloudapi.cn
clustername.azurewebsites.chinacloudapi.cn CNAME cloudservicename.chinacloudapp.cn
cloudservicename.chinacloudapp.cn A 40.122.110.154

When you deploy a private endpoint, we update the DNS entry to point to the canonical name mywebapp.privatelink.chinacloudsites.cn. For example, the name resolution is:

Name Type Value Remark
mywebapp.chinacloudsites.cn CNAME mywebapp.privatelink.chinacloudsites.cn
mywebapp.privatelink.chinacloudsites.cn CNAME clustername.azurewebsites.chinacloudapi.cn
clustername.azurewebsites.chinacloudapi.cn CNAME cloudservicename.chinacloudapp.cn
cloudservicename.chinacloudapp.cn A 40.122.110.154 <--This public IP isn't your private endpoint, you receive a 403 error

You must set up a private DNS server or an Azure DNS private zone. For tests, you can modify the host entry of your test machine. The DNS zone that you need to create is: privatelink.chinacloudsites.cn. Register the record for your app with a A record and the private endpoint IP. For example, the name resolution is:

Name Type Value Remark
mywebapp.chinacloudsites.cn CNAME mywebapp.privatelink.chinacloudsites.cn <--Azure creates this CNAME entry in Azure Public DNS to point the app address to the private endpoint address
mywebapp.privatelink.chinacloudsites.cn A 10.10.10.8 <--You manage this entry in your DNS system to point to your private endpoint IP address

After this DNS configuration, you can reach your app privately with the default name mywebapp.chinacloudsites.cn. You must use this name, because the default certificate is issued for *.chinacloudsites.cn.

If you need to use a custom DNS name, you must add the custom name in your app and you must validate the custom name like any custom name, using public DNS resolution. For more information, see custom DNS validation.

For the Kudu console, or Kudu REST API (deployment with Azure DevOps Services self-hosted agents for example) you must create two records pointing to the private endpoint IP in your Azure DNS private zone or your custom DNS server. The first is for your app, the second is for the SCM of your app.

Name Type Value
mywebapp.privatelink.chinacloudsites.cn A PrivateEndpointIP
mywebapp.scm.privatelink.chinacloudsites.cn A PrivateEndpointIP

App Service Environment v3 special consideration

In order to enable private endpoint for apps hosted in an IsolatedV2 plan (App Service Environment v3), you have to enable the private endpoint support at the App Service Environment level. You can activate the feature by the Azure portal in the App Service Environment configuration pane, or through the following CLI:

az appservice ase update --name myasename --allow-new-private-endpoint-connections true

Specific requirements

If the virtual network is in a different subscription than the app, you must ensure that the subscription with the virtual network is registered for the Microsoft.Web resource provider. You can explicitly register the provider by following this documentation but you also automatically register the provider when you create the first web app in a subscription.

Pricing

For pricing details, see Azure Private Link pricing.

Limitations

  • When you use Azure Function in Elastic Premium plan with private endpoint, to run or execute the function in Azure portal you must have direct network access or you receive an HTTP 403 error. In other words, your browser must be able to reach the private endpoint to execute the function from the Azure portal.
  • You can connect up to 100 private endpoints to a particular app.
  • Remote Debugging functionality isn't available through the private endpoint. The recommendation is to deploy the code to a slot and remote debug it there.
  • FTP access is provided through the inbound public IP address. Private endpoint doesn't support FTP access to the app.
  • IP-Based SSL isn't supported with private endpoints.
  • Apps that you configure with private endpoints can't receive public traffic coming from subnets with Microsoft.Web service endpoint enabled and can't use service endpoint-based access restriction rules.
  • Private endpoint naming must follow the rules defined for resources of type Microsoft.Network/privateEndpoints. Naming rules can be found here.

We're improving Azure Private Link feature and private endpoint regularly, check this article for up-to-date information about limitations.

Next steps