Restrict import/export access for managed disks using Azure Private Link

Article
11/15/2021
2 minutes to read

Applies to: ✔️ Linux VMs ✔️ Windows VMs ✔️ Flexible scale sets ✔️ Uniform scale sets

You can use private endpoints to restrict the export and import of managed disks and more securely access data over a private link from clients on your Azure virtual network. The private endpoint uses an IP address from the virtual network address space for your managed disks. Network traffic between clients on their virtual network and managed disks only traverses over the virtual network and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

To use Private Link to export and import managed disks, first you create a disk access resource and link it to a virtual network in the same subscription by creating a private endpoint. Then, associate a disk or a snapshot with a disk access instance.

Limitations

Your virtual network must be in the same subscription as your disk access object to link them.
You can't import or export more than five disks or snapshots at the same time with the same disk access object.
You can't request manual approval to link a virtual network to a disk access object.

Create a disk access resource

Sign in to the Azure portal and navigate to Disk Accesses with this link.

Important

You must use the provided link to navigate to the Disk Accesses pane. It is not currently visible in the public portal without using the link.
Select + Create to create a new disk access resource.
On the Create a disk accesses pane, select your subscription and a resource group. Under Instance details, enter a name and select a region.
Select Review + create.
When your resource has been created, navigate directly to it.

Create a private endpoint

Next, you'll need to create a private endpoint and configure it for disk access.

From your disk access resource, under Settings, select Private endpoint connections.
Select + Private endpoint.
In the Create a private endpoint pane, select a resource group.
Provide a name and select the same region in which your disk access resource was created.
Select Next: Resource.
On the Resource pane, select Connect to an Azure resource in my directory.
For Resource type, select Microsoft.Compute/diskAccesses.
For Resource, select the disk access resource you created earlier.
Leave the Target sub-resource as disks.
Select Next : Configuration.
Select the virtual network to which you will limit disk import and export. This prevents the import and export of your disk to other virtual networks.

Note

If you have a network security group enabled for the selected subnet, it will be disabled for private endpoints on this subnet only. Other resources on this subnet will retain network security group enforcement.
Select the appropriate subnet.
Select Review + create.

Enable private endpoint on your disk

Navigate to the disk you'd like to configure.
Under Settings, select Networking.
Select Private endpoint (through disk access) and select the disk access you created earlier.
Select Save.

You've now configured a private link that you can use to import and export your managed disk.

Next steps

Upload a VHD to Azure or copy a managed disk to another region - Azure CLI or Azure PowerShell module
Download a VHD - Windows or Linux
FAQ for private links and managed disks
Export/Copy managed snapshots as VHD to a storage account in different region with PowerShell