Azure virtual network service endpoints (2023)

The virtual network (VNet) service endpoint provides a secure and direct connection to Azure services via an optimized route over the Azure backbone network. With endpoints, you can secure your critical Azure service resources only in your virtual networks. Service endpoints allow private IP addresses in the VNet to reach the endpoint of an Azure service without requiring a public IP address in the VNet.

Service endpoints are available for the following Azure services and regions. theMicrosoft.*Resource is in brackets. Enable this resource from the subnet page while configuring service endpoints for your service:

Generally available

• Azure storage(Microsoft.Storage): Generally available in all Azure regions.
• Azure SQL-Datenbank(Microsoft.Sql): Generally available in all Azure regions.
• Azure Synapse Analytics(Microsoft.Sql): Generally available in all Azure regions for dedicated SQL pools (formerly SQL DW).
• Azure Database for PostgreSQL-Server(Microsoft.Sql): Generally available in Azure regions where the database service is available.
• Azure database for MySQL server(Microsoft.Sql): Generally available in Azure regions where the database service is available.
• Azure Database for MariaDB(Microsoft.Sql): Generally available in Azure regions where the database service is available.
• Azure Cosmos DB(Microsoft.AzureCosmosDB): Generally available in all Azure regions.
• Azure Key Vault(Microsoft.KeyVault): Generally available in all Azure regions.
• Azure-Servicebus(Microsoft.ServiceBus): Generally available in all Azure regions.
• Azure Event Hubs(Microsoft.EventHub): Generally available in all Azure regions.
• Azure Data Lake Store Gen 1(Microsoft.AzureActiveDirectory): Generally available in all Azure regions where ADLS Gen1 is available.
• Azure-App-Service(Microsoft.Web): Generally available in all Azure regions where App Service is available.
• Azure Cognitive Services(Microsoft.CognitiveServices): Generally available in all Azure regions where Cognitive Services are available.

Public Preview

• Azure Container Registry(Microsoft.ContainerRegistry): Preview available in restricted Azure regions where Azure Container Registry is available.

For the latest notifications, go toAzure Virtual Network-UpdatesPage.

Main Benefits

Service endpoints provide the following benefits:

• Improved security for your Azure service resources: Private VNet address spaces can overlap. You cannot use overlapping spaces to uniquely identify traffic originating from your VNet. Service endpoints enable securing Azure service resources in your virtual network by extending VNet identity to the service. After you enable service endpoints in your virtual network, you can add a virtual network rule to secure the Azure service resources in your virtual network. The added rule provides improved security by completely removing public internet access to resources and allowing traffic only from your virtual network.

• Optimal routing for Azure service traffic from your virtual network: Today, any routes in your virtual network that force internet traffic to your on-premises and/or virtual appliances also force Azure service traffic to take the same route as internet traffic. Service endpoints provide optimal routing for Azure traffic.

  Endpoints always route service traffic directly from your virtual network to the service on the Microsoft Azure backbone network. Keeping traffic in the Azure backbone network allows you to further inspect and monitor outbound internet traffic from your virtual networks through forced tunneling without impacting service traffic. For more information on custom routes and forced tunneling, seeTraffic routing for Azure virtual networks.

• Easy setup with less administration: You no longer need reserved, public IP addresses in your virtual networks to protect Azure resources with an IP firewall. No Network Address Translation (NAT) or gateway devices are required to set up the service endpoints. You can configure service endpoints with a single selection on a subnet. There is no additional overhead for managing the endpoints.

limitations

• The feature is only available for virtual networks deployed through the Azure Resource Manager deployment model.
• Endpoints are enabled on subnets configured in Azure virtual networks. Endpoints cannot be used for traffic from your site to Azure services. For more information, seeSecure access to Azure services on-premises
• With Azure SQL, a service endpoint applies only to Azure service traffic within a virtual network's region. For Azure Storage this is possibleEnable access to virtual networks in other regionsin the preview.
• For Azure Data Lake Storage (ADLS) Gen 1, the VNet integration feature is only available for virtual networks within the same region. Also note that ADLS Gen1 virtual network integration uses virtual network service endpoint security between your virtual network and Azure Active Directory (Azure AD) to generate additional security claims in the access token. These claims are then used to authenticate and grant access to your virtual network with your Data Lake Storage Gen1 account. theMicrosoft.AzureActiveDirectoryThe tag listed under Services supporting service endpoints is only used to support ADLS Gen 1 service endpoints. Azure AD doesn't natively support service endpoints. For more information on Azure Data Lake Store Gen 1 VNet integration, seeNetwork security in Azure Data Lake Storage Gen1.

Secure Azure services in virtual networks

• A virtual network service endpoint provides the identity of your virtual network to the Azure service. After you enable service endpoints in your virtual network, you can add a virtual network rule to secure the Azure service resources in your virtual network.

  (Video) How to create Service Endpoints for Virtual Networks in Azure

• Today, traffic from Azure services from a virtual network uses public IP addresses as source IP addresses. For service endpoints, the service traffic switches to using private virtual network addresses as source IP addresses when accessing the Azure service over a virtual network. This switch allows you to access the services without requiring reserved, public IP addresses used in IP firewalls.

  note

  For service endpoints, the source IP addresses of virtual machines on the subnet for service traffic switch from using public IPv4 addresses to using private IPv4 addresses. Existing firewall rules for Azure services that use Azure public IP addresses will no longer work with this switch. Ensure that the Azure service's firewall rules allow this transition before setting up service endpoints. Configuring service endpoints can also temporarily disrupt service traffic from that subnet.

Secure access to Azure services on-premises

By default, Azure service resources secured in virtual networks are not reachable from on-premises networks. If you want to allow on-premises traffic, you must also allow public IP addresses (usually NAT) from your on-premises or ExpressRoute. You can add these IP addresses through IP firewall configuration for Azure service resources.

ExpressRoute: If you useExpressRouteFor public peering or Microsoft peering from your location, you need to identify the NAT IP addresses you are using. By default, for public peering, each ExpressRoute circuit uses two NAT IP addresses that are applied to Azure service traffic as the traffic enters the Microsoft Azure network backbone. For Microsoft peering, the NAT IP addresses are either provided by the customer or provided by the service provider. To allow access to your service resources, you must allow these public IP addresses in the resource IP firewall setting.Open a support ticket with ExpressRoutevia the Azure portal. For more information on NAT for ExpressRoute and Microsoft public peering, seeNAT requirements for ExpressRoute.

Construction

• Configure service endpoints on a subnet in a virtual network. Endpoints work with any type of compute instance running within that subnet.
• You can configure multiple service endpoints for any supported Azure service (such as Azure Storage or Azure SQL Database) in a subnet.
• Azure SQL Database requires virtual networks to be in the same region as the Azure service resource. For Azure Storage this is possibleEnable access to virtual networks in other regionsin the preview. For all other services, you can back up Azure virtual network service resources in any region.
• The virtual network in which the endpoint is configured can be in the same or a different subscription as the Azure service resource. For more information about permissions required to set up endpoints and secure Azure services, seedeployment.
• For supported services, you can use service endpoints to secure new or existing virtual network resources.

considerations

• After enabling a service endpoint, the source IP addresses switch from using public IPv4 addresses to using their private IPv4 address when communicating with the service from that subnet. Any existing open TCP connections to the service will be closed during this switch. Ensure that no critical tasks are running when you enable or disable a service endpoint for a service on a subnet. Also ensure that your applications can automatically connect to Azure services after the IP address change.

  (Video) Azure Virtual Network and PaaS Network Controls

  The IP address change only affects service traffic from your virtual network. There is no impact on other traffic destined to or from the public IPv4 addresses assigned to your virtual machines. If you have existing firewall rules for Azure services that use Azure public IP addresses, those rules will no longer work when you switch to private virtual network addresses.

• With service endpoints, DNS records for Azure services remain unchanged and continue to resolve to public IP addresses assigned to the Azure service.

• Network Security Groups (NSGs) with service endpoints:

  • By default, NSGs allow outbound internet traffic and also allow traffic from your VNet to Azure services. This traffic works unmodified with service endpoints.
  • If you want to deny all outbound internet traffic and only allow traffic to specific Azure services, you can do that withService-Tagsin your NSGs. You can target supported Azure services in your NSG rules, and Azure also provides IP address management underlying each tag. For more information, seeAzure service tags for NSGs.

scenarios

• Peered, connected, or multiple virtual networks: To secure Azure services for multiple subnets within a virtual network or across multiple virtual networks, you can enable service endpoints in each of the subnets independently and secure Azure service resources for all subnets.
• Filter outbound traffic from a virtual network to Azure services: If you want to inspect or filter traffic sent from a virtual network to an Azure service, you can deploy a network virtual appliance inside the virtual network. You can then apply service endpoints to the subnet where the virtual network device is deployed and secure Azure service resources only for that subnet. This scenario can be useful if you want to use virtual network device filtering to restrict Azure service access from your virtual network to only specific Azure resources. For more information, seeOutput with virtual network devices.
• Securing Azure resources for services deployed directly into virtual networks: You can deploy different Azure services directly to specific subnets in a virtual network. You can back up Azure service resources formanaged serviceSubnets by setting up a service endpoint on the managed service's subnet.
• Disk traffic from an Azure virtual machine: Virtual machine disk traffic for managed and unmanaged disks is not affected by service endpoint routing changes for Azure Storage. This traffic includes DiskIO and mounts and unmounts. You can restrict REST access to page blobs to select networks through service endpoints andAzure storage network rules.

Logging and Troubleshooting

After configuring service endpoints for a specific service, verify that the service endpoint route is in effect by:

• Validation of the source IP address of each service request in the service diagnosis. All new requests with service endpoints show the source IP address for the request as the private virtual network IP address assigned to the client making the request from your virtual network. Without the endpoint, the address is an Azure public IP address.
• View the effective routes on each network interface in a subnet. The way to service:
  • Displays a more specific default route to address each service's prefix ranges
  • Has a nextHopType ofVirtualNetworkServiceEndpoint
  • Indicates a more direct connection to the service compared to forced tunneling routes

deployment

Service endpoints can be configured independently from a user with write access to a virtual network in virtual networks. To back up Azure service resources in a VNet, the user must have the appropriate permissionMicrosoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/actionfor the added subnets. The built-in service administrator roles include this permission by default. You can change permission by creating custom roles.

For more information about built-in roles, seeBuilt-in Azure roles. For more information about assigning specific permissions to custom roles, seeAzure custom roles.

Virtual networks and Azure service resources can be in the same or different subscriptions. Certain Azure services (not all), such as Azure Storage and Azure Key Vault, also support service endpoints across different Active Directory (AD) tenants. This means that the virtual network and the Azure service resource can be in different Active Directory (AD) tenants. For more information, see the relevant service documentation.

Prices and Limits

There are no additional charges for using service endpoints. The current pricing model for Azure services (Azure Storage, Azure SQL Database, etc.) remains unchanged.

The total number of service endpoints in a virtual network is unlimited.

Certain Azure services, such as Accounts, such as Azure storage accounts, can enforce limits on the number of subnets used to secure the resource. For information about various services, see the documentation in theNext Stepssection for details.

VNet service endpoint policies

Endpoint policies for VNet services enable you to filter virtual network traffic to Azure services. This filter allows only specific Azure service resources through service endpoints. Service endpoint policies provide granular access control for virtual network traffic to Azure services. For more information, seeVirtual network service endpoint policies.

frequently asked Questions

For frequently asked questions seeFrequently asked questions about the virtual network service endpoint.

Next Steps

• Configure virtual network service endpoints
• Back up an Azure Storage account in a virtual network
• Back up an Azure SQL Database in a virtual network
• Secure Azure Synapse Analytics in a virtual network
• Compare private endpoints and service endpoints
• Virtual network service endpoint policies
• Azure Resource Manager template