azure appservice on private VNET

Question

I have tried the premium app service with "vent" integration. the endpoint https://xxxx.azurewebsites.net. however, still I can reach this URL from the internet. why is that? I need to block the Internet access. the only thing I can access from azure DevOps for CI/CD . assume this is MSFT service so I can allow via service principal.

My question is what I need to do to block internet access from internet and only allow from azure devops? I have tried the new Private endpoint but that block from my azure DevOps(CI/CD)

thanks!!!

Answer 1

Hi @pauloselias-8841,

Apologies for the delay in response. Based on the Azure docs "The VNet Integration feature enables your apps to access resources in or through a VNet. VNet Integration doesn't enable your apps to be accessed privately."

You may want to try Using Private Endpoints for your Azure Web App:

You can use Private Endpoint for your Azure Web App to allow clients located in your private network to securely access the app over Private Link. The Private Endpoint uses an IP address from your Azure VNet address space. Network traffic between a client on your private network and the Web App traverses over the VNet and a Private Link on the Microsoft backbone network, eliminating exposure from the public Internet.

If you just need a secure connection between your VNet and your Web App, a Service Endpoint is the simplest solution. If you also need to reach the web app from on-premises through an Azure Gateway, a regionally peered VNet, or a globally peered VNet, Private Endpoint is the solution.

For more information, see Service Endpoints.

Please keep in mind that the VNet integration feature cannot use the same subnet as Private Endpoint, this is a limitation of the VNet integration feature.

Hope that helps.

Let us know if you have further questions.

Thanks,
Grace