Private Endpoints¶

Connect App Service to backend services over private networking using VNet integration and private endpoints for SQL, Redis, and Key Vault.

flowchart TD
    A[App Service with VNet integration] --> B[Private DNS zones]
    B --> C[Private Endpoint SQL]
    B --> D[Private Endpoint Redis]
    B --> E[Private Endpoint Key Vault]
    C --> F[Private backend connectivity]
    D --> F
    E --> F

Prerequisites¶

• App Service Plan tier that supports VNet integration
• Virtual network with dedicated integration subnet
• Backend services configured for private endpoint support

Main Content¶

1) Networking architecture¶

Recommended layout:

• snet-appservice-integration: delegated for App Service VNet integration
• snet-private-endpoints: hosts private endpoint NICs
• Private DNS zones linked to the VNet

2) Enable VNet integration (Linux App Service)¶

az webapp vnet-integration add \
  --resource-group "$RG" \
  --name "$APP_NAME" \
  --vnet "$VNET_NAME" \
  --subnet "snet-appservice-integration" \
  --output json

3) Create private endpoint for Azure SQL¶

az network private-endpoint create \
  --resource-group "$RG" \
  --name "pe-sql-guide" \
  --vnet-name "$VNET_NAME" \
  --subnet "snet-private-endpoints" \
  --private-connection-resource-id "/subscriptions/<subscription-id>/resourceGroups/<sql-rg>/providers/Microsoft.Sql/servers/<sql-server>" \
  --group-id sqlServer \
  --connection-name "pe-sql-guide-conn" \
  --output json

4) Create private endpoint for Redis¶

az network private-endpoint create \
  --resource-group "$RG" \
  --name "pe-redis-guide" \
  --vnet-name "$VNET_NAME" \
  --subnet "snet-private-endpoints" \
  --private-connection-resource-id "/subscriptions/<subscription-id>/resourceGroups/<redis-rg>/providers/Microsoft.Cache/Redis/<redis-name>" \
  --group-id redisCache \
  --connection-name "pe-redis-guide-conn" \
  --output json

5) NSG and route guidance¶

Allow outbound from integration subnet to:

• SQL private endpoint IP on 1433
• Redis private endpoint IP on 6380
• Key Vault private endpoint IP on 443

Block broad internet egress only after dependencies are confirmed reachable.

6) Connection string and DNS assumptions¶

Keep service hostnames unchanged (for example, <sql-server>.database.windows.net). Private DNS resolution should map these names to private endpoint IPs within the VNet.

7) App code stays unchanged¶

Spring Boot automatically picks up connection details from environment variables or application.properties.

# application.properties
spring.datasource.url=jdbc:sqlserver://<sql-server>.database.windows.net:1433;database=<db-name>;encrypt=true;
spring.data.redis.host=<redis-name>.redis.cache.windows.net
spring.data.redis.port=6380
spring.data.redis.ssl=true

The same code can run with public or private networking if configuration and DNS are consistent.

8) GitHub Actions networking validation step¶

- name: Validate private endpoint state
  run: |
    az network private-endpoint list \
      --resource-group "$RG" \
      --output table

Verification¶

1. Confirm VNet integration is connected.
2. Confirm private endpoints are in Approved state.
3. Confirm app can reach SQL/Redis with normal hostnames.

az webapp vnet-integration list --resource-group "$RG" --name "$APP_NAME" --output table

Use dependency telemetry and synthetic API checks to verify end-to-end connectivity.

Troubleshooting¶

Name resolution still points to public IP¶

• Validate private DNS zone records.
• Ensure VNet links are correct.
• Confirm app is integrated with expected VNet/subnet.

Connection timeout to backend¶

• Review NSG rules and UDRs.
• Confirm backend firewall permits private endpoint traffic.
• Check TLS settings for SQL/Redis client configuration.

Intermittent connectivity during scale events¶

Use resilient retry settings (Spring Data JPA retry logic, Redis reconnect behavior) and monitor transient errors.

Run It in the Portal¶

Portal view: Networking blade (app-side precondition for backend private endpoints)¶

Purpose: Show the app's inbound and outbound network configuration on one page.

Look for: Public network access and Private endpoints under inbound traffic, and Virtual network integration, Outbound DNS, and the outbound address lists under outbound traffic.

Expected result: This capture shows the displayed configuration of a public app without VNet integration: the listed outbound addresses are the platform's potential outbound address pool (not a measured egress address for any connection), and the integration subnet settings show N/A.

This web-app Networking blade is a supporting before-state for the recipe rather than the place where the SQL, Redis, and Key Vault private endpoints themselves are listed. The visible Virtual network integration: Not configured row is the app-side prerequisite the recipe changes before private DNS for those backend services can work, while Private endpoints: 0 private endpoints also makes clear the screenshot is not showing downstream private endpoints attached to other resources. Use this capture as the pre-integration checkpoint before running the recipe's VNet integration and backend private-endpoint steps, then revisit Spring's data-access retry settings (JPA retry logic, Redis Lettuce reconnect) once the private path is live.

See Also¶

• Azure SQL
• Redis Cache
• VNet Integration
• Platform: How App Service Works

Sources¶

• Use private endpoints for Azure App Service apps
• Integrate your app with an Azure virtual network