Private Network Deploy¶

Deploy the Java app with private outbound connectivity, a storage private endpoint, and system-assigned managed identity.

flowchart TD
    USER[Internet client] -->|HTTPS| APP[App Service\nLinux Java 17]
    APP -.->|System-assigned MI| ENTRA[Microsoft Entra ID]

    subgraph VNET[Virtual Network 10.10.0.0/16]
        INT[Integration subnet\n10.10.1.0/24]
        PE[Private endpoint subnet\n10.10.2.0/24]
    end

    APP --> INT
    PE_ST[Private Endpoint: Storage blob] --> STORAGE[Storage Account]
    PE --> PE_ST
    DNS[Private DNS zone\nprivatelink.blob.core.windows.net] -.-> PE_ST
    APP -->|Private DNS resolution| DNS

    style APP fill:#0078d4,color:#fff
    style VNET fill:#E8F5E9,stroke:#4CAF50
    style DNS fill:#E3F2FD

Prerequisites¶

• Completed 02. First Deploy
• Basic or higher App Service plan
• Permission to create VNets, subnets, private endpoints, private DNS zones, and role assignments
• Existing Java app that already runs in App Service

Main Content¶

Step 1: Set advanced deployment variables¶

RG="rg-java-guide"
APP_NAME="app-java-guide-abc123"
LOCATION="koreacentral"
VNET_NAME="vnet-java-guide"
INTEGRATION_SUBNET_NAME="snet-appservice-integration"
PRIVATE_ENDPOINT_SUBNET_NAME="snet-private-endpoints"
STORAGE_NAME="stjavaguideabc123"
PRIVATE_DNS_ZONE_NAME="privatelink.blob.core.windows.net"

Step 2: Create the VNet and both subnets¶

az network vnet create --resource-group $RG --name $VNET_NAME --location $LOCATION --address-prefixes 10.10.0.0/16
az network vnet subnet create --resource-group $RG --vnet-name $VNET_NAME --name $INTEGRATION_SUBNET_NAME --address-prefixes 10.10.1.0/24 --delegations Microsoft.Web/serverFarms
az network vnet subnet create --resource-group $RG --vnet-name $VNET_NAME --name $PRIVATE_ENDPOINT_SUBNET_NAME --address-prefixes 10.10.2.0/24 --disable-private-endpoint-network-policies true

Step 3: Connect the web app to the integration subnet¶

az webapp vnet-integration add --resource-group $RG --name $APP_NAME --vnet $VNET_NAME --subnet $INTEGRATION_SUBNET_NAME

Step 4: Enable managed identity¶

az webapp identity assign --resource-group $RG --name $APP_NAME
APP_PRINCIPAL_ID="$(az webapp identity show --resource-group $RG --name $APP_NAME --query principalId --output tsv)"

Step 5: Create a storage account, private endpoint, and private DNS zone¶

az storage account create --resource-group $RG --name $STORAGE_NAME --location $LOCATION --sku Standard_LRS --kind StorageV2
STORAGE_ID="$(az storage account show --resource-group $RG --name $STORAGE_NAME --query id --output tsv)"
az network private-endpoint create --resource-group $RG --name pe-storage-blob --vnet-name $VNET_NAME --subnet $PRIVATE_ENDPOINT_SUBNET_NAME --private-connection-resource-id $STORAGE_ID --group-id blob --connection-name pe-storage-blob-connection
az network private-dns zone create --resource-group $RG --name $PRIVATE_DNS_ZONE_NAME
az network private-dns link vnet create --resource-group $RG --zone-name $PRIVATE_DNS_ZONE_NAME --name link-java-guide-vnet --virtual-network $VNET_NAME --registration-enabled false
az network private-endpoint dns-zone-group create --resource-group $RG --endpoint-name pe-storage-blob --name storage-blob-zone-group --private-dns-zone $PRIVATE_DNS_ZONE_NAME --zone-name blob

Step 6: Grant the managed identity access to Storage¶

az role assignment create --assignee-object-id $APP_PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "Storage Blob Data Contributor" --scope $STORAGE_ID

Step 7: Configure the app to use the storage endpoint¶

az webapp config appsettings set --resource-group $RG --name $APP_NAME --settings STORAGE_ACCOUNT_URL="https://$STORAGE_NAME.blob.core.windows.net"

Step 8: Use DefaultAzureCredential in the app¶

import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.storage.blob.BlobServiceClient;
import com.azure.storage.blob.BlobServiceClientBuilder;

BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
    .endpoint(System.getenv("STORAGE_ACCOUNT_URL"))
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

Step 9: Verify networking and identity¶

az webapp vnet-integration list --resource-group $RG --name $APP_NAME --output table
az network private-endpoint show --resource-group $RG --name pe-storage-blob --query "{name:name,provisioningState:provisioningState}" --output json
az role assignment list --assignee $APP_PRINCIPAL_ID --scope $STORAGE_ID --output table

Step 10: Restrict the storage account's public network access¶

With the private endpoint, private DNS zone, and RBAC role in place, close the storage account's public endpoint.

az storage account update --resource-group $RG --name $STORAGE_NAME --public-network-access Disabled --default-action Deny

Verification¶

• az webapp vnet-integration list shows the integration subnet
• az network private-endpoint show returns Succeeded
• az role assignment list shows Storage Blob Data Contributor
• The app uses DefaultAzureCredential and does not require a storage key or connection string

Troubleshooting¶

The app still resolves the public storage endpoint¶

• Confirm the private DNS zone is linked to the same VNet used for App Service integration.
• Confirm the private endpoint DNS zone group exists.

The app gets 403 Forbidden from Storage¶

• Wait a few minutes for RBAC propagation.
• Recheck the role assignment scope and principal ID.

The app cannot reach the private endpoint¶

• Confirm the app is integrated with the expected subnet.
• Review NSG and route table changes if you added them after initial validation.

Run It in the Portal¶

Portal view: Access Restrictions blade (before-state inbound access configuration)¶

Purpose: Show the inbound access state before any access restriction is added.

Look for: Public network access shows Enabled (using default behavior), Unmatched rule action is Allow, and the only rule is Allow all with priority 2147483647.

Expected result: With no custom rules, the displayed default-endpoint policy admits any source until you add rules or disable public network access. This is a configuration reading, not a measured reachability test.

The Access Restrictions blade is the Portal surface that displays the access configuration of this app while you work through the recipe's VNet integration, managed identity, and storage private endpoint steps for the Spring Boot BlobServiceClient flow. In the visible default state, Public network access is enabled with default behavior and the rules table contains only Allow all, so this screenshot works as a before-state reminder that those outbound/private-connectivity steps do not by themselves change the displayed inbound configuration. The blade shows configuration, not whether any client can reach the app: a private endpoint, DNS, routing and the applicable main-site or SCM policy (depending on the target and ingress path) also decide that, and the effective-policy reading is in Private Endpoint and Access Restriction Decisions. Use it only as a before-state configuration reference, not as evidence that the recipe itself has already added access-restriction rules.

See Also¶

• VNet Integration
• Private Endpoints
• Managed Identity

Sources¶

• Integrate your app with an Azure virtual network
• Use private endpoints for Azure App Service apps
• Use managed identities for App Service and Azure Functions