Manage network policies for private endpoints

By default, network policies are disabled for a subnet in a virtual network. To utilize network policies like UDR and NSG support, network policy support must be enabled for the subnet. This setting is only applicable to private endpoints within the subnet. This setting affects all private endpoints within the subnet. For other resources in the subnet, access is controlled based on security rules in the network security group.

You can use the following to enable or disable the setting:

  • Azure portal

  • Azure PowerShell

  • Azure CLI

  • Azure Resource Manager templates

The following examples describe how to enable and disable PrivateEndpointNetworkPolicies for a virtual network named myVNet with a default subnet of 10.1.0.0/24 hosted in a resource group named myResourceGroup.

Enable network policy

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Virtual network. Select Virtual networks.

  3. Select myVNet.

  4. In settings of myVNet, select Subnets.

  5. Select the default subnet.

  6. In the properties for the default subnet, select Enabled in NETWORK POLICY FOR PRIVATE ENDPOINTS.

  7. Select Save.

Disable network policy

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Virtual network. Select Virtual networks.

  3. Select myVNet.

  4. In settings of myVNet, select Subnets.

  5. Select the default subnet.

  6. In the properties for the default subnet, select Disabled in NETWORK POLICY FOR PRIVATE ENDPOINTS.

  7. Select Save.

Next steps