Connect to Cosmos DB via VPN Gateway Connection

Joel Forsyth 26 Reputation points

We are looking to secure our Cosmos DB accounts by restricting access to selected subnets in our virtual network as described in the documentation.

In testing, it works as described. I must connect to the VPN Gateway to gain access to the Virtual Network, log on to a VM within the allowed subnet, then I can access the Cosmos data.

My question: Is it possible to skip the "middle man" here and just connect to Cosmos by connecting to the VPN Gateway? While I am connected to the gateway, my requests to Cosmos are still routed through the public internet and are blocked. I have given the gateway subnet access to the Cosmos account, but it still fails. I'm just trying to make sure there isn't something I could configure that would easily allow this access. If we have to connect to a VM within the virtual network for access, and that is how it was designed, then so be it.

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,311 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,026 questions
Azure Cosmos DB
Azure Cosmos DB
An Azure NoSQL database service for app development.
1,351 questions
0 comments No comments
{count} votes

Accepted answer
  1. msrini-MSFT 9,241 Reputation points Microsoft Employee

    @Joel Forsyth ,

    You can enable Private Endpoints for Cosmos DB and you get a private IP address from the VNET space to which you need to connect to. BY that way you can connect from On-Prem via VPN directly.

    But you need to take care of some DNS configurations to achieve this.


    Karthik Srinivas

0 additional answers

Sort by: Most helpful