Cant create private endpoint because of subnet delegation

Question

Hi, I am facing difficulties to disallow public access to my storage account. This account is being accessed by function apps, web apps, and web APIs. What I have tried so far, is that I integrated the web app with the VNet I created, and also configured storage account's networking settings to only accept traffic through this VNet. Then I went on to create a private endpoint, but it said that this subnet has delegation so it cant create private endpoint in it. Deleting delegation means I need to remove VNet integration with web app, as mentioned in: https://learn.microsoft.com/en-us/answers/questions/809744/unable-to-delete-the-delegation-from-subnet

So I am confused how can I achieve this goal, how can I integrate all these services together in a VNet with storage account? I tried creating a VM as well in this VNet so that I can test access to the storage account from the VNet but seems like I cant do so in the same subnet again because it has a delegation.

Answer 1

Hello Najam ul Saqib,

Thank you for posting your query here!

You cannot use a ‘Subnet Delegation’ along with a ‘Private endpoint’ since that subnet is delegated for the said service. Through a subnet delegation, you can define the NSG association for it, as well as associate multiple delegated subnets to a common NSG. You can also define the IP Address space for the delegated subnet, the route table association with it, the custom DNS entry configuration in Azure DNS as well as define the minimum number of IP Addresses available for that delegated subnet. Similarly, with regards to service endpoint, these stated functions are not available.

In service endpoint, you do not have control over the routing mechanism as well as the IP address related allotment, reservation, or configuration. Also, managing DNS entries for the resources managed through them and controlling them through a firewall or NAT gateway isn’t required unlike a subnet delegation because all these things are managed by Microsoft Azure’s backbone network on your behalf.

Thus, both have their own features and specifications for enabling you to configure according to your own requirements.

You can only deploy another subnet in your VNet and there create your private link because subnet with existing delegation to an azure service cannot be used for private links.

Default routing and NSG allows communication within the same VNet.

Additional information:

https://learn.microsoft.com/en-us/azure/virtual-network/manage-subnet-delegation?tabs=manage-subnet-delegation-portal

https://learn.microsoft.com/en-us/azure/virtual-network/subnet-delegation-overview

Please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.