How to create a Microsoft.ApiManagement Private Endpoint to access Azure API?

Kris Jankiewicz 1

We need to be able for on-premise to access Azure API management and Windows.NET services to ensure private communications via ExpressRoute from end to end. When trying to create a private endpoint using Microsoft.ApiManagement/service, the resource list is empty.

KapilAnanth-MSFT 35,251 Reputation points Microsoft Employee

2022-09-27T03:33:37.633+00:00
Hi @Kris Jankiewicz ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to create a Private EndPoint with API Management.

I believe you have followed this document to configure: Connect privately to API Management using a private endpoint

Can you please share a screenshot of the section in which you are facing the issue?

If it is under "Resource" Section, may I recommend you to give it a try using the other Connection method.
-

Please let me know if any of my understanding is incorrect.

Cheers,
Kapil
Kris Jankiewicz 1 Reputation point

2022-09-28T20:51:22.853+00:00

I think the main issue here is that we do not understand what the API Management can access. We need a backup device which is on-premise to access VM resources privately via ExpressRoute (already in place). All we can do is access the VM via it's private IP in the vNet, but our backup device needs to add Azure source using a private IP (Private Endpoint) in order to register them using their private IPs and not via the Internet. The on-premise backup device does not have Internet access locally nor via ExpressRoute/vNet.
KapilAnanth-MSFT 35,251 Reputation points Microsoft Employee

2022-09-29T05:38:37.51+00:00

Hi @Kris Jankiewicz ,

A PrivateEnd Point is used to provide access from an Azure VM or OnPrem server to a PaaS resource (in our case, it's APIM) over a private network.
The traffic can only originate towards the PaaS and not from the PaaS.

So, the PaaS service cannot initiate traffic towards an Azure VM or OnPrem server via PrivateEndPoint.

If your goal is to make APIM initiate traffic to OnPrem, then PrivateEndPoint is not the right way.
The other way round is possible, i.e, OnPrem to APIM via PE.

I did not quite get the part, "our backup device needs to add Azure source using a private IP (Private Endpoint) in order to register them using their private IPs"
Can you please elaborate on this?

Cheers,
Kapil.
Kris Jankiewicz 1 Reputation point

2022-10-03T19:27:42.77+00:00

Hi Kapil,

Yes, we would be doing "OnPrem to APIM via PE". We need the OnPrem backup device to access Azure API to get the list of VMs and their IPs. We were told by the vendor it can be done using a Private Endpoint to APIM. How do we configure the PE to access VM info so the backup device can add the VMs and get their private IP info. The other question is, how to access the VM storage? Would another PE be needed for that? The backup device normally initiates a snapshot and ingests the changed data.
KapilAnanth-MSFT 35,251 Reputation points Microsoft Employee

2022-10-04T05:38:45.657+00:00
Hi @Kris Jankiewicz ,

Thanks for the explanation.

Wrt, "OnPrem to APIM via PE"

This is doable via Private EndPoint.

Wrt, "How do we configure the PE to access VM info so the backup device can add the VMs and get their private IP info"

I don't think so PE is the correct solution here

As stated, a connection cannot originate from a PE.

From the documents, I found this : Connect to a virtual network in internal mode using Azure API Management

I am not aware of the configuration of APIM part to access a VM's storage from APIM.

As a general rule, PEs are used to provide private connectivity to a PaaS service from IaaS VMs, not the other way around.
To connect to VMs/Servers from a PaaS service, we should use VNet integration.

I hope this helps.

Cheers,
Kapil