How can I restrict my Custom Domain Azure Static Web App to only be accessible internally and not publicly accessible?

Question

How can I restrict my Custom Domain Azure Static Web App to only be accessible internally and not publicly accessible?

EnterpriseArchitect 6,391

I created the Azure static website and wanted to publish this only to my internal office users across multiple locations.

Each office is connected via ExpressRoute circuit to Azure, so how do I restrict this Static Web app so that it can only be accessed using the Custom domain name I have like: CustomApp1.domain.com ?

0 comments

Answer accepted by question author

KapilAnanth 49,876 Moderator

@EnterpriseArchitect

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are working with Azure Static Web App and not Static website hosting in Azure Storage

Please let me know if my understanding is incorrect.

I believe you should use a Private EndPoint to make the site only accessible via Private (internal) network.

Your exact requirement is documented here : Configure private endpoint in Azure Static Web Apps

NOTE:

If your app has a private endpoint enabled, the server responds with a 403 status code if the request comes from a public IP address.
This behavior applies to both the production environment as well as any staging environments.
The only way to reach the app is to use the private endpoint deployed within your VNet

Also, you must take care of the DNS Resolution part so that "CustomApp1.domain.com" resolves to a private IP and not a Public IP within your private network.

You can follow this architecture for DNS : Virtual network and on-premises workloads using a DNS forwarder

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

EnterpriseArchitect 6,391 Reputation points

2023-10-06T06:07:44.89+00:00

Hi @kapil ananth ,
Yes, I am deploying the Static Web Apps.

What's the difference between Express and Advance Private Endpoint?
EnterpriseArchitect 6,391 Reputation points

2023-10-06T06:09:12.8433333+00:00

My public DNS hosting has been updated to allow this CustomApp1.domain.com to work both externally and internally.
TP 162.1K Reputation points Volunteer Moderator

2023-10-06T06:21:03.04+00:00

Advanced just gives you a few extra options to customize how it creates the private endpoint. For example, you can set the name of private endpoint nic and set private IP config.
EnterpriseArchitect 6,391 Reputation points

2023-10-06T06:35:12.78+00:00

OK, when I selected the Express, which Virtual Network should I peer with?

Do I need to create the custom Subnets and then select the Integrate with Private DNS zone?
KapilAnanth 49,876 Reputation points Moderator

2023-10-06T09:08:18.56+00:00
EnterpriseArchitect

It is recommended to use the Hub VNET.

I believe, in your case, it will be the VNET where the ExpressRoute Gateway is deployed.

It is not mandatory or a requirement to use a custom Subnet, you can use any subnet you want.

Wrt Private DNS Zones,

In case you use a custom DNS server in Azure, the Private DNS Zone should be associated to the VNET which has this custom DNS server.

Virtual network workloads using a DNS forwarder

In case you use Azure Provided DNS, you should associate the Zone to the Hub VNET all the Spoke VNETs.

Virtual network workloads without custom DNS server

Cheers,

Kapil.
EnterpriseArchitect 6,391 Reputation points

2023-10-06T11:48:29.8833333+00:00

Hi @kapil ananth ,

My Public DNS server is OnPremise, so do I need to set the Integrate with private DNS zone to No ?

I do not have an ExpressRoute gateway, only the ExpressRoute circuits https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FexpressRouteCircuits

Does associating the Express Endpoint Virtual network with the ExpressRoute Circuit cause any outage?
KapilAnanth 49,876 Reputation points Moderator

2023-10-06T12:08:53.89+00:00
@KapilAnanth

Wrt, "My Public DNS server is OnPremise, so do I need to set the Integrate with private DNS zone to No ?"

In this case, yes, you do not have to integrate the Private DNS Zone.

Please make sure the VMs in Azure will also be able to use your Public DNS server from OnPremise to resolve to the Private IP.

When you say, "I do not have an ExpressRoute gateway, only the ExpressRoute circuits"

Then may I ask how is connection between your Azure VNET and OnPREM is established?

Connect a virtual network to an ExpressRoute circuit

Can you please share your network architecture diagram?

Please note that if you do not have a VNet, then you cannot create a private end point.

For this setup to work, you must have

A VNET with a VNET Gateway

This VNET Gateway should be connected to the ExpressRoute Circuit

Your OnPREM must be connected to the ExpressRoute Circuit

The below diagram can help you understand how Private EndPoint can be connected from an OnPrem:

Cheers,

Kapil.
EnterpriseArchitect 6,391 Reputation points

2023-10-06T12:41:28.66+00:00

@kapil ananth ,
Apologize for the confusion, I can confirm that I have Virtual network gateways as can be seen from https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworkGateways
EnterpriseArchitect 6,391 Reputation points

2023-10-06T12:49:12.98+00:00

@kapil ananth ,
Yes, the Public DNS IP address entries are all accessible globally.

so I assume a setting like this will work?
EnterpriseArchitect 6,391 Reputation points

2023-10-06T13:04:29.73+00:00

@kapil ananth ,
This is what I am trying to achieve:
KapilAnanth 49,876 Reputation points Moderator

2023-10-06T15:01:01.4033333+00:00
EnterpriseArchitect

I see your custom domain is "portal-internal.domain.com"

Can you please confirm if the Custom Domain association is done?

If so, are you using Azure DNS or External provider ?

Open CMD as admin and do nslookup <yourCustomDomain>

Please share the results.

If not, you must first configure the custom domain as documented here : https://learn.microsoft.com/en-us/azure/static-web-apps/custom-domain

Please note that Custom domain and Private EndPoint are two different steps and you must configure the Custom domain before creating using a private endPoint for the custom domain.

Cheers,

Kapil

EnterpriseArchitect 6,391

@kapil ananth ,

If so, are you using Azure DNS or External provider ?

I am using an External Provider for the External Public DNS servers

Open CMD as admin and do nslookup <yourCustomDomain>

This is the result:

Name:    waws-prod-hk1-4b467133.sip.p.azurewebsites.windows.net
Address:  13.88.65.123
Aliases:  portal-internal.domain.com
          icy-pond-008be3f03.1.azurestaticapps.net
          azurestaticapps3.trafficmanager.net
          msha-slice-2-hk1-0.msha-slice-2-hk1-0-ase.p.azurewebsites.net

KapilAnanth 49,876 Reputation points Moderator

2023-10-10T05:18:22.8033333+00:00
EnterpriseArchitect ,

Thanks for confirming you are using External Provider.

I don't think so you have created a Private Endpoint yet.

Because, with private endpoint, you should see an additional entry.

The Domain will have a "privatelink" in it's name

Can you please share the screenshot of your custom domain set as default?

Can you also share the Private EndPoint screenshot?

Is it approved?

Thanks, Kapil
KapilAnanth 49,876 Reputation points Moderator

2023-10-11T14:23:57.6933333+00:00

EnterpriseArchitect,

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
KapilAnanth 49,876 Reputation points Moderator

2023-10-13T06:58:11.8066667+00:00

@KapilAnanth

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil
EnterpriseArchitect 6,391 Reputation points

2023-10-13T11:36:43.44+00:00

Thank you @kapil ananth
KapilAnanth 49,876 Reputation points Moderator

2023-10-13T12:48:27.8633333+00:00

EnterpriseArchitect,

You are welcome.

Cheers,

Kapil

1 additional answer

Your answer

EnterpriseArchitect 6,391 Reputation points

2023-10-06T06:07:44.89+00:00

Hi @kapil ananth ,
Yes, I am deploying the Static Web Apps.

What's the difference between Express and Advance Private Endpoint?
EnterpriseArchitect 6,391 Reputation points

2023-10-06T06:09:12.8433333+00:00

My public DNS hosting has been updated to allow this CustomApp1.domain.com to work both externally and internally.
TP 162.1K Reputation points Volunteer Moderator

2023-10-06T06:21:03.04+00:00

Advanced just gives you a few extra options to customize how it creates the private endpoint. For example, you can set the name of private endpoint nic and set private IP config.
EnterpriseArchitect 6,391 Reputation points

2023-10-06T06:35:12.78+00:00

OK, when I selected the Express, which Virtual Network should I peer with?

Do I need to create the custom Subnets and then select the Integrate with Private DNS zone?
KapilAnanth 49,876 Reputation points Moderator

2023-10-06T09:08:18.56+00:00

EnterpriseArchitect

It is recommended to use the Hub VNET.

I believe, in your case, it will be the VNET where the ExpressRoute Gateway is deployed.

It is not mandatory or a requirement to use a custom Subnet, you can use any subnet you want.

Wrt Private DNS Zones,

In case you use a custom DNS server in Azure, the Private DNS Zone should be associated to the VNET which has this custom DNS server.

Virtual network workloads using a DNS forwarder

In case you use Azure Provided DNS, you should associate the Zone to the Hub VNET all the Spoke VNETs.

Virtual network workloads without custom DNS server

Cheers,

Kapil.
EnterpriseArchitect 6,391 Reputation points

2023-10-06T11:48:29.8833333+00:00

Hi @kapil ananth ,

My Public DNS server is OnPremise, so do I need to set the Integrate with private DNS zone to No ?

I do not have an ExpressRoute gateway, only the ExpressRoute circuits https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FexpressRouteCircuits

Does associating the Express Endpoint Virtual network with the ExpressRoute Circuit cause any outage?
KapilAnanth 49,876 Reputation points Moderator

2023-10-06T12:08:53.89+00:00

@KapilAnanth

Wrt, "My Public DNS server is OnPremise, so do I need to set the Integrate with private DNS zone to No ?"

In this case, yes, you do not have to integrate the Private DNS Zone.

Please make sure the VMs in Azure will also be able to use your Public DNS server from OnPremise to resolve to the Private IP.

When you say, "I do not have an ExpressRoute gateway, only the ExpressRoute circuits"

Then may I ask how is connection between your Azure VNET and OnPREM is established?

Connect a virtual network to an ExpressRoute circuit

Can you please share your network architecture diagram?

Please note that if you do not have a VNet, then you cannot create a private end point.

For this setup to work, you must have

A VNET with a VNET Gateway

This VNET Gateway should be connected to the ExpressRoute Circuit

Your OnPREM must be connected to the ExpressRoute Circuit

The below diagram can help you understand how Private EndPoint can be connected from an OnPrem:

Cheers,

Kapil.
EnterpriseArchitect 6,391 Reputation points

2023-10-06T12:41:28.66+00:00

@kapil ananth ,
Apologize for the confusion, I can confirm that I have Virtual network gateways as can be seen from https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworkGateways
EnterpriseArchitect 6,391 Reputation points

2023-10-06T12:49:12.98+00:00

@kapil ananth ,
Yes, the Public DNS IP address entries are all accessible globally.

so I assume a setting like this will work?
EnterpriseArchitect 6,391 Reputation points

2023-10-06T13:04:29.73+00:00

@kapil ananth ,
This is what I am trying to achieve:
KapilAnanth 49,876 Reputation points Moderator

2023-10-06T15:01:01.4033333+00:00

EnterpriseArchitect

I see your custom domain is "portal-internal.domain.com"

Can you please confirm if the Custom Domain association is done?

If so, are you using Azure DNS or External provider ?

Open CMD as admin and do nslookup <yourCustomDomain>

Please share the results.

If not, you must first configure the custom domain as documented here : https://learn.microsoft.com/en-us/azure/static-web-apps/custom-domain

Please note that Custom domain and Private EndPoint are two different steps and you must configure the Custom domain before creating using a private endPoint for the custom domain.

Cheers,

Kapil
EnterpriseArchitect 6,391 Reputation points

2023-10-09T02:01:59.2966667+00:00

@kapil ananth ,

If so, are you using Azure DNS or External provider ?

I am using an External Provider for the External Public DNS servers

Open CMD as admin and do nslookup <yourCustomDomain>

This is the result:

Name: waws-prod-hk1-4b467133.sip.p.azurewebsites.windows.net Address: 13.88.65.123 Aliases: portal-internal.domain.com icy-pond-008be3f03.1.azurestaticapps.net azurestaticapps3.trafficmanager.net msha-slice-2-hk1-0.msha-slice-2-hk1-0-ase.p.azurewebsites.net
KapilAnanth 49,876 Reputation points Moderator

2023-10-10T05:18:22.8033333+00:00

EnterpriseArchitect ,

Thanks for confirming you are using External Provider.

I don't think so you have created a Private Endpoint yet.

Because, with private endpoint, you should see an additional entry.

The Domain will have a "privatelink" in it's name

Can you please share the screenshot of your custom domain set as default?

Can you also share the Private EndPoint screenshot?

Is it approved?

Thanks, Kapil
KapilAnanth 49,876 Reputation points Moderator

2023-10-11T14:23:57.6933333+00:00

EnterpriseArchitect,

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
KapilAnanth 49,876 Reputation points Moderator

2023-10-13T06:58:11.8066667+00:00

@KapilAnanth

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil
EnterpriseArchitect 6,391 Reputation points

2023-10-13T11:36:43.44+00:00

Thank you @kapil ananth
KapilAnanth 49,876 Reputation points Moderator

2023-10-13T12:48:27.8633333+00:00

EnterpriseArchitect,

You are welcome.

Cheers,

Kapil

Answer 1

TP 162.1K Volunteer Moderator

Hi,

You could create Private Endpoint and this will cause connections coming from public IPs to be denied. Only connections coming through the private endpoint will be allowed. The site will no longer be available via multiple worldwide points of presence.

Configure private endpoint in Azure Static Web Apps

https://learn.microsoft.com/en-us/azure/static-web-apps/private-endpoint

Please click Accept Answer if above was useful.

Thanks.

-TP

EnterpriseArchitect 6,391 Reputation points

2023-10-13T11:36:30.3133333+00:00

Thank you @TP,