Azure monitor workbook custom endpoint query to function app behind private endpoint

Martin Macko 15

Hi guys,

In Azure Monitor workbooks I want to create my own workbook where the query would call azure function app. This is possible by choosing custom endpoint option while creating new query. Everything works as expected when using azure function with public endpoint.

But, when I use Azure function with private endpoint it doesn't work. CORS is not a problem, I even tried * in function's CORS for testing purposes.

I tried to use also Azure Monitor Private Link Scopes but without success.

So, I guess it is not possible to call Azure function behind private endpoint from workbooks ?

User's image

Thanks for any help.

Konstantinos Passadis 17,286 Reputation points

2023-05-13T19:35:36.95+00:00
Hello @MartinMacko-9882!

I understand you want to call an Azure Function from your queries using Private Endpoint

As of this Documentation :

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security

With Azure Private Link, you can securely link Azure platform as a service (PaaS) resources to your virtual network by using private endpoints. Azure Monitor is a constellation of different interconnected services that work together to monitor your workloads. An Azure Monitor private link connects a private endpoint to a set of Azure Monitor resources to define the boundaries of your monitoring network. That set is called an Azure Monitor Private Link Scope (AMPLS).

Going through the Doc i understand that is you need to pay attention in the detail .

Remember , DNS is crucial for Private Endpoints to work !

https://learn.microsoft.com/en-us/azure/azure-functions/functions-create-vnet

Understand private DNS zones

You've used a private endpoint to connect to Azure resources. You're connecting to a private IP address instead of the public endpoint. Existing Azure services are configured to use an existing DNS to connect to the public endpoint. You must override the DNS configuration to connect to the private endpoint.

A private DNS zone is created for each Azure resource that was configured with a private endpoint. A DNS record is created for each private IP address associated with the private endpoint.

The following DNS zones were created in this tutorial:

*privatelink.file.core.windows.net* *privatelink.blob.core.windows.net* *privatelink.servicebus.windows.net* *privatelink.azurewebsites.net*

If you provide more details i could help by recreating teh whole thing

But i am confident that if you take it slowly read well , you will achieve the goal!

Feel free to send additional feeeback !

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards
Martin Macko 15 Reputation points

2023-05-14T09:34:59.3233333+00:00

Hi @Konstantinos Passadis

So I put VM inside the vnet where my Azure function app and Azure Monitor Private Link Scopes private endpoint are located.

I first tried nslookup myapp.azurewebsites.net and it correctly responded with private endpoint ip and name (privatelink.azurewebsites.net). Same for AMPLS names.

It is because when you create private endpoint it creates also private dns zones for you and it attaches it to the vnet.

But when I tried to trigger azure function from the VM it was not working. So after some research I added following settings into my function app configuration:

WEBSITE_DNS_SERVER 192.63.129.16

WEBSITE_VNET_ROUTE_ALL 1

After this change I can now trigger my function from VM using original url myapp.azurewebsites.net...

But when I tried it again from Application Insights app for which I created AMPLS and private endpoint, it still shows the same error. I just guess that it is not possible to call azure function which is behind private endpoint from workbooks.

Also everywhere in documentation about AMPLS it is only mentioned that it allows you to connect TO Monitor resources but nowhere is mentioned that it works both ways so also FROM.

It would be nice if someone from MS can confirm.
Konstantinos Passadis 17,286 Reputation points

2023-05-14T09:49:49.8333333+00:00

Hello @MartinMacko-9882!

Have you seen this :

From : https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-data-sources#custom-endpoint

Custom endpoint

Workbooks support getting data from any external source. If your data lives outside Azure, you can bring it to workbooks by using this data source type.

To make a query control that uses this data source, use the Data source dropdown and select Custom Endpoint. Provide the appropriate parameters, such as Http method, url, headers, url parameters, and body. Make sure your data source supports CORS. Otherwise, the request will fail.

To avoid automatically making calls to untrusted hosts when you use templates, you need to mark the used hosts as trusted. You can either select Add as trusted or add it as a trusted host in workbook settings. These settings will be saved in browsers that support IndexDb with web workers.

This provider supports JSONPath.

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards
Martin Macko 15 Reputation points

2023-05-14T09:54:16.4033333+00:00

Yes, as you can see on the screenshot from the first post, there you can see I am using custom endpoint, I also mentioned that CORS is not a problem.

I think it is just not possible.

Martin
Konstantinos Passadis 17,286 Reputation points

2023-05-14T12:32:38.9166667+00:00

Hello @MartinMacko-9882!

I really want to replicate the issue .

Let me try , whatever info you think can help me do this faster is welcome!

Thank you in advance !

2 answers

Konstantinos Passadis 17,286 Reputation points

2023-05-14T14:45:12.8+00:00

Hello @MartinMacko-9882!

Well i am really disappointed . because i can verify that it is not supported - working

Did all the steps , and the final one was to go on the function App and disable Public Access from Access Restrictions , on the Networking Tab

If for any reason the DNS was resoving correctly without the need to add privatelink into the URL, then when asking the Original URL of the Function via the Query it should have worked. Once Public Access was shutdown it stopped

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards
Please sign in to rate this answer.
Martin Macko 15 Reputation points

2023-05-14T15:35:07.9166667+00:00

Thanks for your time Konstantinos!

I hope MS will work to make it possible in future. There are always some limitations in Azure.

Konstantinos Passadis 17,286 Reputation points

2023-05-14T15:48:38.6166667+00:00

Hello @MartinMacko-9882!

It is my pleasure !

I hope so because it is helpful to be able to fo this kind of tests , without exposing your Apps and Functions , and utilizing the Private Endpoint abilities!

In case any answer helped kindly mark it as Accepted and upvote so others can benefit as well!

Regards
Sign in to comment
AnuragSingh-MSFT 19,856 Reputation points

2023-05-15T05:29:12.1133333+00:00

Thank you MartinMacko-9882 and @Konstantinos Passadis for taking time to share your findings here with the community. I apologize for the inconvinience.

I would like to add the following to this discussion. As discussed above, the workbook does not have the capability now to connect to private link (or call resources with only Private Link access), which also means that for LA/AI workspace which have blocked query access from public network, the data cannot be queries from Azure Monitor workbook. For more details, please see Control network access to your resources

I would request posting this feedback as an idea here - Azure monitor feedback so that it can be considered by the team in future.
Please sign in to rate this answer.
Martin Macko 15 Reputation points

2023-05-15T07:54:52.3133333+00:00

Hi @AnuragSingh-MSFT

Thanks. I created the feature request.

https://feedback.azure.com/d365community/idea/464038a4-f5f2-ed11-a81c-000d3a7a9cdb

Martin
Sign in to comment