Azure Front Door Private Endpoint to APIM

Question

Azure Front Door Private Endpoint to APIM

Alex 495

Hello,

I recently added an APIM origin in AFD with PLS enabled.

After that, I noticed a lot of private endpoint approval requests (around 18 endpoints) pop up in my APIM instance and I had to approve each one individually.

QQs:

Why so many private endpoint approval request? Is it because of each private endpoint created for each AFD edge server?
1. If in the future, Azure expands their AFD footprint and introduces new edge servers in new regions, do I need to again initiate this process or will it be done automatically or do I need to again approve that request?
How to verify if all these endpoint requests are initiated from my AFD instance? apart from the request message.
Is there a way to approve all requests in one shot?
Do I need to bear the cost of all these private endpoints?
If I disable the PLS of the origin later, would it auto delete the private endpoints created in the origin or do I need to manually delete them one by one again?

Shravan Addagatla 540 Reputation points Microsoft External Staff

2025-04-08T17:47:36.6533333+00:00
Hi Alex

I could understand that you have configured AFD with origin as APIM with Private Link Service enabled and noticed multiple private endpoints created to the APIM instance.

Please see the below information for your queries.

Why so many private endpoint approval request? Is it because of each private endpoint created for each AFD edge server?

If in the future, Azure expands their AFD footprint and introduces new edge servers in new regions, do I need to again initiate this process, or will it be done automatically or do I need to again approve that request?

I would like to inform you that multiple approval requests on private endpoints are likely due to the below reasons.

Same Resource ID and Group ID: If you create multiple AFD origins with the same set of Private Link resource ID and group ID, only one private endpoint should be created. However, if there are changes in the region, resource ID, or group ID, new private endpoints will be created, which may lead to the behavior you are observing.

Profile Changes: If the AFD profile changes or if you are enabling Private Link for origins in different Front Door profiles, this will also result in the creation of additional private endpoints that require approval.

Refer the below articles: -
https://learn.microsoft.com/en-us/azure/frontdoor/private-link#multiple-private-endpoints

https://learn.microsoft.com/en-us/answers/questions/2236806/container-apps-environemnt-afd-multiple-private-en

How to verify if all these endpoint requests are initiated from my AFD instance? apart from the request message.

You can try to use Azure Monitor logs to track incoming private endpoint requests.

Is there a way to approve all requests in one shot?

Currently, Azure does not provide a bulk approval option for private endpoints. However, you can try to automate approvals using below Azure PowerShell and this script loops through all pending private endpoint requests and approves them.

Get-AzPrivateEndpointConnection | ForEach-Object { Approve-AzPrivateEndpointConnection -ResourceId $_.Id }

Do I need to bear the cost of all these private endpoints?

Yes, each private endpoint incurs a cost. Pricing includes:

$0.01 per hour per private endpoint.

Inbound/Outbound data processing charges (varies by usage).

For more details, check out Azure Private Link pricing.

If I disable the PLS of the origin later, would it auto delete the private endpoints created in the origin or do I need to manually delete them one by one again?

Disabling Private Link Service (PLS) does not automatically delete the private endpoints created for the origin. You will need to manually delete each private endpoint associated with the service.

If above is unclear and/or you are unsure about something add a comment below.

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.
Alex 495 Reputation points

2025-04-09T04:27:44.6033333+00:00
Thanks, Shravan.

Follow-up QQs:

Looks like disabling the PLS at AFD deleted the private endpoints (all states Pending, Approved and Rejected) by Azure Traffic Manager and DNS, after a while. Not sure how randomly it got kicked in and deleted the endpoints

Regarding multiple private endpoint requests

There is only one AFD profile, one Origin Group with one APIM origin, one PLS region, same hostname and target sub resource - ideally as per doc, only one private endpoint request should have sent. Not sure why multiple popped up.

Cost is clear.

Approving each private endpoint request via the PS command - would it wait for each private endpoint approval processing before proceeding to others or it will just iterate and approve it? Because APIM takes like 5-6mins to update the service after approving 1 endpoint request.
Shravan Addagatla 540 Reputation points Microsoft External Staff

2025-04-09T18:45:25.0033333+00:00

Hello Alex

Thanks for the response.

Azure Traffic Manager and DNS will have an automated cleanup mechanism that activates the events under certain conditions and it's interesting that disabling PLS at AFD caused the deletion of private endpoints across all states. It might behave differently on the APIM instance.

To investigate further, please check the activity logs in Azure Monitor could reveal the exact sequence of events and reasons for the multiple private endpoint creations. Sometimes, additional private endpoint requests can be triggered due to internal replication or redundancy mechanisms.

For PowerShell approvals, the Approve-AzPrivateEndpointConnection command typically iterates through requests and approves them sequentially. However, it does not necessarily wait for each approval to fully process before moving to the next, since APIM takes several minutes to update after each approval.
Shravan Addagatla 540 Reputation points Microsoft External Staff

2025-04-10T13:49:02.4033333+00:00

Hello Alex

I just wanted to check if you had a chance to review my last response and please let us know if you have any questions.

thanks,
Shravan Addagatla 540 Reputation points Microsoft External Staff

2025-04-11T13:15:36.5+00:00

Hi Alex

Just checking in to see if above information was helpful. If above is unclear and/or you are unsure about something add a comment below.

Your answer

Alex 495 Reputation points

2025-04-09T04:27:44.6033333+00:00

Thanks, Shravan.

Follow-up QQs:

Looks like disabling the PLS at AFD deleted the private endpoints (all states Pending, Approved and Rejected) by Azure Traffic Manager and DNS, after a while. Not sure how randomly it got kicked in and deleted the endpoints

Regarding multiple private endpoint requests

There is only one AFD profile, one Origin Group with one APIM origin, one PLS region, same hostname and target sub resource - ideally as per doc, only one private endpoint request should have sent. Not sure why multiple popped up.

Cost is clear.

Approving each private endpoint request via the PS command - would it wait for each private endpoint approval processing before proceeding to others or it will just iterate and approve it? Because APIM takes like 5-6mins to update the service after approving 1 endpoint request.
Shravan Addagatla 540 Reputation points Microsoft External Staff

2025-04-09T18:45:25.0033333+00:00

Hello Alex

Thanks for the response.

Azure Traffic Manager and DNS will have an automated cleanup mechanism that activates the events under certain conditions and it's interesting that disabling PLS at AFD caused the deletion of private endpoints across all states. It might behave differently on the APIM instance.

To investigate further, please check the activity logs in Azure Monitor could reveal the exact sequence of events and reasons for the multiple private endpoint creations. Sometimes, additional private endpoint requests can be triggered due to internal replication or redundancy mechanisms.

For PowerShell approvals, the Approve-AzPrivateEndpointConnection command typically iterates through requests and approves them sequentially. However, it does not necessarily wait for each approval to fully process before moving to the next, since APIM takes several minutes to update after each approval.
Shravan Addagatla 540 Reputation points Microsoft External Staff

2025-04-10T13:49:02.4033333+00:00

Hello Alex

I just wanted to check if you had a chance to review my last response and please let us know if you have any questions.

thanks,
Shravan Addagatla 540 Reputation points Microsoft External Staff

2025-04-11T13:15:36.5+00:00

Hi Alex

Just checking in to see if above information was helpful. If above is unclear and/or you are unsure about something add a comment below.

Share via

Azure Front Door Private Endpoint to APIM

Your answer