Azure Managed Grafana doesn't currently support connections to private networks ?

Question

Azure Managed Grafana doesn't currently support connections to private networks ?

Ashish Dadhich 56

Going through https://learn.microsoft.com/en-us/azure/managed-grafana/troubleshoot-managed-grafana#solution-review-network-settings-and-ip-address , mentioned "Azure Managed Grafana doesn't currently support connections to private networks"

It's a blocker for us as we are trying to connect to data source "Azure Database for PostgreSQL flexible server" that is configured with Vnet Integration (https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking-private-link)

Is there any way to fix this? or feature request to support that.

Monalla-MSFT 13,166 Reputation points Moderator

2024-04-22T12:39:37.6533333+00:00

@Ashish Dadhich - Just checking in to see if any of the below answers helped. If this answers your query, do click "Accept as Answer" and click "Yes" for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

2 answers

Your answer

Monalla-MSFT 13,166 Reputation points Moderator

2024-04-22T12:39:37.6533333+00:00

@Ashish Dadhich - Just checking in to see if any of the below answers helped. If this answers your query, do click "Accept as Answer" and click "Yes" for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

Monalla-MSFT 13,166 Moderator

@Ashish Dadhich - Thanks for reaching out to us.

On top of what Sander has suggested, I would like to add few points to provide more context from our engineering team.

Our Product team has just added functionality to connect privately using Managed Private Endpoints on AMG (https://learn.microsoft.com/en-us/azure/managed-grafana/how-to-connect-to-data-source-privately) to PostgreSQL, it’s being rolled out right now and should be available in a week on the portal. That said, this option with only for Postgres setup that has private endpoint enabled. But if the Postgres setup has VNet injection enabled, then the AMG MPE will not work.

If this option doesn't work for you, then unfortunately the only workaround right now is to use Deterministic IPs on your AMG instance (https://learn.microsoft.com/en-us/azure/managed-grafana/how-to-deterministic-ip) and allow these IPs to communicate from outsite your VNET on your NSG/firewall rules on the Postgres setup. The true Vnet Injection support for AMG is a long way out on our roadmap.

Hope this helps. and please feel free to reach out if you have any further questions.

Please don't forget to "Accept as Answer" and click "Yes" if the above response if helpful, so it can be beneficial to the community.

Ashish Dadhich 56 Reputation points

2024-04-09T15:54:34.6633333+00:00

Thank you @Monalla-MSFT for sharing the update. I think I am good for now.
Thank you @Sander van de Velde | MVP for all your help and suggestions.
Monalla-MSFT 13,166 Reputation points Moderator

2024-04-09T17:44:29.91+00:00

Ashish Dadhich - Glad the above answers helped resolve your issue.

Please don't forget to "Accept as Answer" and Click Yes" if any of the above answers helped resolve your issue, so it can be beneficial to the community.
Csudinka Csudutov 0 Reputation points

2026-02-06T18:27:27.7366667+00:00

Sir, I have set up our AMG with Deterministic IP's. Also allowed those IP's on the firewall to access the PostgreSQL Flexible Server. Still, I am getting the error of "no such host". I guess that's because those IP's only ensure that the Postgre lets the AMG IN. But it doesn't enable the AMG to see that FQDN, that is in a VNET. (Like most enterprise PostgreSQL Servers.)
Also, adding a private endpoint to the AMG ensures that other resources can talk to the AMG, not that the AMG can resolve DNS which is in a private network, if I understand well... So, I have the same problem as Ashish Dadhich.
Do you have an advice here?

Answer 2

Sander van de Velde | MVP 37,056 MVP Volunteer Moderator

Hello @Ashish Dadhich,

welcome to this moderated Azure community forum.

Please double check the documentation.

you'll learn how to disable public access to your Azure Managed Grafana workspace and set up private endpoints. Setting up private endpoints in Azure Managed Grafana increases security by limiting incoming traffic only to specific network.

Notice this is a feature of the Azure Managed Grafana instance in the Standard tier.

So it seems to be possible to work with VNET integration.

Please check that documentation and follow the steps.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Ashish Dadhich 56 Reputation points

2024-04-08T15:03:04.87+00:00
Thank you for reply !

When we try to setup managed managed private endpoint on grafana

We don't see following Resource type

Microsoft.DBforPostgreSQL/flexibleServers
Sander van de Velde | MVP 37,056 Reputation points MVP Volunteer Moderator

2024-04-08T15:07:41.7933333+00:00

Hello @Ashish Dadhich,

can you share the full command you use to check this?

Are you sure you have created a standard tier Azure managed Grafana?
Ashish Dadhich 56 Reputation points

2024-04-08T15:22:14.65+00:00

I am trying manually on portal. Yes, we created standard tier.

On portal

Networking section of Azure Managed Grafana -> Create new managed private endpoint

Select Resource Type : where we don't see Microsoft.DBforPostgreSQL/flexibleServers
Sander van de Velde | MVP 37,056 Reputation points MVP Volunteer Moderator

2024-04-08T19:47:51.65+00:00

Hello @Ashish Dadhich,

I'm not familiar with the inner workings op PostgreSQL.

These network options are available when creating a Grafana workspace:

I was expecting connecting to a shared VNet/DNS would fix the (private) connection.

Share via

Azure Managed Grafana doesn't currently support connections to private networks ?

2 answers

Your answer