All Azure traffic is being froce tunnel on-prem before going to the internet, however, I want traffic destined to Microsoft services such as intune to go directly to the internet. How is this achievable?

Question

I'm force tunneling my Azure traffic to the internet to on-prem. I want to enroll my VMs to Intune however I don't want traffic destined to Microsoft services (such as Intune) to go on-prem first. The on-prem is advertising routes to virtual gateway via BGP.

Answer 1

Hi,

You can add a Route table with a rule where you can use service tags which states, if the destination is <Service tag> next hop internet.

By doing this, you can route the traffic from Azure VNET to Internet for the service tag IPs, and rest of the traffic will go to On-Prem.

Note: Not all the services are available in Service Tags in UDR. I don't see Intune in here yet.

Regards,

Karthik Srinivas

Answer 2

Wanted to go this way but I equally noticed that there is no service tag for Intune. However, I just created a route table with routes to channel traffic from my specific VMs to internet. It achieved my goal though it was a tiresome experience as the routes were too many.

Thank you for your help though.