how to connect to azure managed instance from different vnet in hub and spoke?

Question

My function app is in Vnet A and MI is in Vnet B. We use hub and spoke topology.

Function app is in spoke A and MI is in spoke B. Public access to MI is disabled now. We have a Azure firewall in the hub.

Answer 1

@Ijaz Muhammad, Gnrgy Welcome to Microsoft Q&A thanks for posting your question.

To connect to an Azure Managed Instance (MI) from a different virtual network (VNet) in a hub and spoke topology, you can use Azure Private Link to create a private endpoint for the MI in your virtual network. https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/private-endpoint-overview?view=azuresql&tabs=separate-vnets

https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql

If you're considering using an Azure application gateway as a shared resource in your network topology, it's usually best to deploy it in a spoke virtual network. found a post for more information. https://learn.microsoft.com/en-us/answers/questions/1279885/azure-application-gateway-as-a-shared-resource-in

For your specific scenario with Azure Firewall in the hub, you may need to create a route table for the spoke virtual network and configure the firewall policy for the hub virtual network Check Here

Regards

Geetha