Does Azure Funcion App on a pricing tier of Standard (S2) support vnet integration?

Question

Does Azure Funcion App on a pricing tier of Standard (S2) support vnet integration?

Fortress Abioye 40

I'm trying to secure my storage account and allow access to the function app without enabling public access. The function app is on a pricing of S2 and I want to know if it supports Vnet integration

JananiRamesh-MSFT 29,236 Reputation points

2023-08-24T06:14:52.77+00:00

Hi Fortress Abioye I hope the answer helps. Please let me know if you have any further queries.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Accepted answer

1 additional answer

Your answer

JananiRamesh-MSFT 29,236 Reputation points

2023-08-24T06:14:52.77+00:00

Hi Fortress Abioye I hope the answer helps. Please let me know if you have any further queries.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Answer 1

TP 116.3K

Hi,

Yes, Standard S2 SKU supports VNet integration. Below article has more information on vnet integration:

https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

Below article has more information on securing your storage account using private endpoint. Your function app could connect to your storage account via private endpoint without enabling public access.

Use private endpoints for Azure Storage

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

Please click Accept Answer if the above was useful.

Thanks.

-TP

Fortress Abioye 40 Reputation points

2023-08-24T16:17:42.0366667+00:00

Thank you for your answers. I'm trying to secure my storage account from public access to private and enable the function app to access it.
After doing vnet integration with my function app and setting up a private endpoint on my storage account, following this link: https://learn.microsoft.com/en-us/azure/azure-functions/configure-networking-how-to?tabs=portal#restrict-your-storage-account-to-a-virtual-network, do I still need to add this dns server entry (in the below image) to my function app to enable it to connect? Note that I use a custom DNS in my environment. And are there other changes I need to do to my DNS after setting up the private endpoint?

Also, is it possible to secure an existing storage account used by a function app or I have to create a new storage account?
TP 116.3K Reputation points

2023-08-24T19:07:28.4366667+00:00

By default if you use VNet integration your app should inherit the DNS settings of the VNet, so it would send DNS requests to 168.63.129.16. If you are using custom DNS then you would need to change the application setting.

Since you are using custom DNS you would need to manually add entry so that your app can resolve the private IP address for your private endpoint.

Yes, you can secure an existing storage account. No need to create new storage account.
Fortress Abioye 40 Reputation points

2023-08-24T19:46:15.7533333+00:00

Thank you very much. I would add the private IP of my private endpoint to my custom DNS server, but in the application settings of my function app, what changes do I have to make?
TP 116.3K Reputation points

2023-08-28T07:00:28.05+00:00

Normally you don't need to add/change your application settings. In the settings on the VNet that you integrate with you set the IP addresses of your custom DNS servers and your function app will pick up that setting. You want to restart the app after you make DNS setting change to the VNet.

To verify, use Kudu CMD prompt to your function environment, then run nameresolver <FQDN> In the output you should see Server: <custom DNS IP address>

If you already have WEBSITE_DNS_SERVER setting you may want to remove it since I think it may override the VNet setting.

NOTE: There have been times when I've noticed strange behavior. For example, I configured custom DNS, restarted app, and it still used Azure DNS. Added WEBSITE_DNS_SERVER, restarted again, and it started using custom DNS, removed WEBSITE_DNS_SERVER, restarted, and it still used custom DNS. Changed VNet back to Azure DNS, restarted, it switched to Azure DNS, change VNet back to custom, restarted, it switched to custom DNS.

The above strange behavior is why I verify using Kudu that it is using proper DNS server for resolving.
Fortress Abioye 40 Reputation points

2023-08-29T15:50:12+00:00

Thank you very much.

After turning on VNET integration and configuring private access, the storage account is not accessible and gave the error that " This request is not authorized to perform this operation", however it is accessible via an internal IP. Is this error related to DNS settings or something else?
TP 116.3K Reputation points

2023-08-30T06:04:29.92+00:00

From your description it sounds like you might be connecting to the public IP for the storage account instead of the private endpoint IP. Does the FQDN you are using to connect resolve to the internal (private endpoint) IP address when you check it via Kudu cmd prompt using nameresolver?

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

Does Azure Funcion App on a pricing tier of Standard (S2) support vnet integration?

1 additional answer

Your answer