Edit

Associate Azure App Configuration with a network security perimeter (private preview)

In this article, you learn how to associate your Azure App Configuration store with a network security perimeter. For more information, see Network security perimeter for Azure App Configuration.

Prerequisites

Sign in to Azure

Sign in to Azure using the az login command in the Azure CLI.

az login

This command prompts your web browser to launch and load an Azure sign-in page. If the browser fails to open, use device code flow with az login --use-device-code. For more sign-in options, go to sign in with the Azure CLI.

Associate your App Configuration store with a network security perimeter

Use the Azure CLI to create an association between your App Configuration store and an existing network security perimeter.

  1. Run the following command to get the resource ID of your App Configuration store. Replace <AppConfigurationStoreName> and <ResourceGroupName> with the name of your store and resource group.

    az appconfig show --name <AppConfigurationStoreName> --resource-group <ResourceGroupName> --query id --output tsv

    Note down the resource ID from the output. For example: /subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>/providers/Microsoft.AppConfiguration/configurationStores/<AppConfigurationStoreName>.

  2. Run the following command to associate your App Configuration store with the network security perimeter. Replace the placeholder values with your own information.

    az network perimeter association create --name <AssociationName> --perimeter-name <NspName> -g <NspResourceGroupName> --access-mode Enforced --private-link-resource "{id:<AppConfigurationResourceId>}" --profile "{id:<NspProfileResourceId>}"
    Placeholder Description Example
    <AssociationName> A name for the new association resource. app-config-association
    <NspName> The name of your network security perimeter. MyNSP
    <NspResourceGroupName> The resource group of your network security perimeter. MyNSPResourceGroup
    <AppConfigurationResourceId> The resource ID of your App Configuration store from the previous step. /subscriptions/.../MyAppConfigStore
    <NspProfileResourceId> The resource ID of the network security perimeter profile to associate with. /subscriptions/.../profiles/defaultProfile

    Tip

    The --access-mode parameter can be set to Learning (called Transition mode in the Azure portal and elsewhere in this documentation) or Enforced. Start in Transition (Learning) mode to validate your access rules before switching to Enforced mode. For more information, see Transitioning to a network security perimeter.

Note

Allow up to 15 minutes for any changes to network security perimeter configuration to take effect.

If you encounter errors while associating your App Configuration store with a network security perimeter, see Troubleshooting for guidance on resolving common issues.

Verify the association

After associating the App Configuration store with the network security perimeter, you can verify the association by checking the network security perimeter configuration of your App Configuration store.

Run the following command to view the network security perimeter configuration for your App Configuration store.

az appconfig network-security-perimeter-configuration list --name <AppConfigurationStoreName> --resource-group <ResourceGroupName>

Dissociate your App Configuration store from a network security perimeter

Use the Azure CLI to remove an existing association between your App Configuration store and a network security perimeter.

  • Run the following command to dissociate your App Configuration store from the network security perimeter. Replace the placeholder values with your own information.

    az network perimeter association delete --name <AssociationName> --perimeter-name <NspName> --resource-group <NspResourceGroupName>
    Placeholder Description Example
    <AssociationName> The name of the association resource to delete. my-association-name
    <NspName> The name of your network security perimeter. my-nsp
    <NspResourceGroupName> The resource group of your network security perimeter. my-resource-group

Related content

  • Last updated on