Using Azure App Service Deployment Slots with Private Endpoint

Question

Seeking some advice on how to solve an issue using Azure App Service Deployment slots and Private Endpoint.

We have deployed an internal Line of Business application in Azure App Service. We want to keep this application completely private and allow connections only to / from the internal on-Premise subnet. The Production Deployment slot is working fine using Site to Site VPN > VNET > Private Endpoint.

The problem is with the Non-Production Deployment slots. We're unable to configure a Private Endpoint for those slots (seems like this is by design?).
Therefore the application in a UAT slot (for example) isn't able to access the internal resources for appropriate validation.

Would love some advice on how to solve this challenge.

• Hybrid Connection to internal Resources
• A separate App Service Plan for Non-Production Environments
• Would ASE solve the issue? (cost prohibitive at the moment)
• Allow access to internal resources from WAN and control by Firewall Access Rules (whitelist)

Answer 1

Hello, If I well understand your question, your UAT environment must be able to consume internal resources, in that case the solution is VNet integration, nothing to deal with Private Endpoint (this feature is only for consumption of the service). And you can use VNet integration with slots.
Yes today you cannot plug Private Endpoint on slots, but it's just that you cannot consume the web app in slots from the private IP.
If your question is also to have access to UAT from onprem through your S2S VPN, you can use another web app on the same plan instead of slot.

Answer 2

Yeah, probably