Associate Azure App Configuration with a network security perimeter

In this article, you learn how to associate your Azure App Configuration store with a network security perimeter. For more information, see Network security perimeter for Azure App Configuration.

Prerequisites

• An Azure account with an active subscription. Create an account for free.
• An App Configuration store. If you need to create one, see Create an App Configuration store.
• An existing network security perimeter. If you need to create one, see Create a network security perimeter in the Azure portal.

Sign in to Azure

Sign in to Azure to access the App Configuration service.

Portal

Sign in to the Azure portal at https://portal.azure.com/ with your Azure account.

Azure CLI

Sign in to Azure using the az login command in the Azure CLI.

az login

This command prompts your web browser to launch and load an Azure sign-in page. If the browser fails to open, use device code flow with az login --use-device-code. For more sign-in options, go to sign in with the Azure CLI.

Associate your App Configuration store with a network security perimeter

Use the portal or Azure CLI to create an association between your App Configuration store and an existing network security perimeter.

Portal

1. In the Azure portal, navigate to your App Configuration store. Under Settings, select Networking.

2. Under Network security perimeter (preview), select Associate.

3. In the Associate a network security perimeter pane, select a network security perimeter and a profile from the drop-down list, then select Associate.

   

Azure CLI

1. Run the following command to get the resource ID of your App Configuration store. Replace <app-config-store-name> and <resource-group> with the name of your store and resource group.

   az appconfig show --name <app-config-store-name> --resource-group <resource-group> --query id --output tsv
   

   Note down the resource ID from the output. For example: /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/MyResourceGroup/providers/Microsoft.AppConfiguration/configurationStores/MyAppConfigStore.

2. Run the following command to associate your App Configuration store with the network security perimeter. Replace the placeholder values with your own information.

   az network perimeter association create --name <association-name> --perimeter-name <nsp-name> -g <nsp-resource-group> --access-mode Enforced --private-link-resource "{id:<app-config-resource-id>}" --profile "{id:<nsp-profile-resource-id>}"
   

   Placeholder	Description	Example
   <association-name>	A name for the new association resource.	app-config-association
   <nsp-name>	The name of your network security perimeter.	MyNSP
   <nsp-resource-group>	The resource group of your network security perimeter.	MyNSPResourceGroup
   <app-config-resource-id>	The resource ID of your App Configuration store from the previous step.	/subscriptions/.../MyAppConfigStore
   <nsp-profile-resource-id>	The resource ID of the network security perimeter profile to associate with.	/subscriptions/.../profiles/defaultProfile

   Tip

   The --access-mode parameter can be set to Learning or Enforced. Start with Learning mode to validate your access rules before switching to Enforced mode. For more information, see Transitioning to a network security perimeter.

Note

Allow up to 15 minutes for any changes to network security perimeter configuration to take effect.

If you encounter errors while associating your App Configuration store with a network security perimeter, see Troubleshooting for guidance on resolving common issues.

Verify the association

After associating the App Configuration store with the network security perimeter, you can verify the association by checking the Networking settings of your App Configuration store.

Portal

1. In the Azure portal, navigate to your App Configuration store. Under Settings, select Networking.

2. Under Network security perimeter, select Manage.

3. Review the network security perimeter configuration to confirm that your App Configuration store is associated with the expected perimeter and profile.

   

Azure CLI

Run the following command to view the network security perimeter configuration for your App Configuration store.

az appconfig network-security-perimeter-configuration list --name <app-config-store-name> --resource-group <resource-group>

Dissociate your App Configuration store from a network security perimeter

Use the portal or Azure CLI to remove an existing association between your App Configuration store and a network security perimeter.

Portal

1. In the Azure portal, navigate to your App Configuration store. Under Settings, select Networking.

2. Under Network security perimeter (preview), select Manage.

3. Select Dissociate.

4. In the Dissociate network security perimeter pane, select Dissociate.

   

Azure CLI

• Run the following command to dissociate your App Configuration store from the network security perimeter. Replace the placeholder values with your own information.

  az network perimeter association delete --name <association-name> --perimeter-name <nsp-name> --resource-group <nsp-resource-group>
  

  Placeholder	Description	Example
  <association-name>	The name of the association resource to delete.	my-association-name
  <nsp-name>	The name of your network security perimeter.	my-nsp
  <nsp-resource-group>	The resource group of your network security perimeter.	my-resource-group

Related content

• Network security perimeter for Azure App Configuration
• Network security overview for Azure App Configuration
• What is Azure network security perimeter?