Private Network Deploy¶

Use this recipe after 02. First Deploy when the app must reach Azure services through VNet integration, private endpoints, and managed identity.

flowchart TD
    INTERNET[Internet users] -->|HTTPS| APP[App Service\nNode.js 24 LTS]

    subgraph VNET[Virtual Network]
        subgraph INT[Integration subnet\nDelegated to Microsoft.Web/serverFarms]
            APP
        end
        subgraph PE[Private endpoint subnet]
            PE_STORAGE[Private Endpoint: Storage]
            PE_KV[Private Endpoint: Key Vault]
        end
    end

    APP -.->|System-assigned identity| ENTRA[Microsoft Entra ID]
    PE_STORAGE --> STORAGE[Storage Account]
    PE_KV --> KV[Key Vault]
    APP --> DNS[Private DNS zones]

    style APP fill:#0078d4,color:#fff
    style VNET fill:#E8F5E9,stroke:#4CAF50
    style DNS fill:#E3F2FD

Overview¶

flowchart TD
    A[Prepare network variables] --> B[Create VNet and subnets]
    B --> C[Add App Service VNet integration]
    C --> D[Enable managed identity]
    D --> E[Create private endpoints and DNS links]
    E --> F[Grant RBAC and configure app settings]
    F --> G[Validate connectivity]

Prerequisites¶

• Completed 02. First Deploy
• Azure CLI authenticated with permission to manage networking and RBAC
• Existing Node.js App Service app
• App Service plan tier that supports VNet integration

Main Content¶

Step 1: Set advanced deployment variables¶

RG="rg-express-tutorial"
LOCATION="koreacentral"
APP_NAME="app-express-tutorial-abc123"
VNET_NAME="vnet-express-tutorial"
INTEGRATION_SUBNET_NAME="snet-appsvc-integration"
PE_SUBNET_NAME="snet-private-endpoints"
STORAGE_NAME="stexpresstutorialabc123"
KEY_VAULT_NAME="kv-express-tutorial-abc123"

Step 2: Create the VNet and required subnets¶

az network vnet create --resource-group $RG --name $VNET_NAME --location $LOCATION --address-prefixes 10.0.0.0/16
az network vnet subnet create --resource-group $RG --vnet-name $VNET_NAME --name $INTEGRATION_SUBNET_NAME --address-prefixes 10.0.1.0/24 --delegations Microsoft.Web/serverFarms
az network vnet subnet create --resource-group $RG --vnet-name $VNET_NAME --name $PE_SUBNET_NAME --address-prefixes 10.0.2.0/24 --disable-private-endpoint-network-policies true

Step 3: Integrate the web app with the VNet¶

az webapp vnet-integration add --resource-group $RG --name $APP_NAME --vnet $VNET_NAME --subnet $INTEGRATION_SUBNET_NAME

Step 4: Enable system-assigned managed identity¶

az webapp identity assign --resource-group $RG --name $APP_NAME

Step 5: Create backend services and private endpoints¶

az storage account create --resource-group $RG --name $STORAGE_NAME --location $LOCATION --sku Standard_LRS --kind StorageV2
az keyvault create --resource-group $RG --name $KEY_VAULT_NAME --location $LOCATION --sku standard
STORAGE_ID="$(az storage account show --resource-group $RG --name $STORAGE_NAME --query id --output tsv)"
KEY_VAULT_ID="$(az keyvault show --resource-group $RG --name $KEY_VAULT_NAME --query id --output tsv)"
az network private-endpoint create --resource-group $RG --name pe-storage-blob --vnet-name $VNET_NAME --subnet $PE_SUBNET_NAME --private-connection-resource-id $STORAGE_ID --group-id blob --connection-name pe-storage-blob-connection
az network private-endpoint create --resource-group $RG --name pe-keyvault --vnet-name $VNET_NAME --subnet $PE_SUBNET_NAME --private-connection-resource-id $KEY_VAULT_ID --group-id vault --connection-name pe-keyvault-connection

Step 6: Create private DNS zones and link them to the VNet¶

az network private-dns zone create --resource-group $RG --name privatelink.blob.core.windows.net
az network private-dns zone create --resource-group $RG --name privatelink.vaultcore.azure.net
az network private-dns link vnet create --resource-group $RG --zone-name privatelink.blob.core.windows.net --name link-storage-dns --virtual-network $VNET_NAME --registration-enabled false
az network private-dns link vnet create --resource-group $RG --zone-name privatelink.vaultcore.azure.net --name link-keyvault-dns --virtual-network $VNET_NAME --registration-enabled false
az network private-endpoint dns-zone-group create --resource-group $RG --endpoint-name pe-storage-blob --name storage-zone-group --private-dns-zone privatelink.blob.core.windows.net --zone-name blob
az network private-endpoint dns-zone-group create --resource-group $RG --endpoint-name pe-keyvault --name keyvault-zone-group --private-dns-zone privatelink.vaultcore.azure.net --zone-name vault

Step 7: Grant RBAC and configure app settings¶

PRINCIPAL_ID="$(az webapp identity show --resource-group $RG --name $APP_NAME --query principalId --output tsv)"
az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "Storage Blob Data Contributor" --scope $STORAGE_ID
az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "Key Vault Secrets User" --scope $KEY_VAULT_ID
az webapp config appsettings set --resource-group $RG --name $APP_NAME --settings STORAGE_ACCOUNT_URL="https://$STORAGE_NAME.blob.core.windows.net" KEY_VAULT_URI="https://$KEY_VAULT_NAME.vault.azure.net/"

Step 8: Use managed identity in Node.js and validate¶

const { DefaultAzureCredential } = require("@azure/identity");
const { BlobServiceClient } = require("@azure/storage-blob");
const { SecretClient } = require("@azure/keyvault-secrets");

const credential = new DefaultAzureCredential();

const blobServiceClient = new BlobServiceClient(process.env.STORAGE_ACCOUNT_URL, credential);
const secretClient = new SecretClient(process.env.KEY_VAULT_URI, credential);

az webapp vnet-integration list --resource-group $RG --name $APP_NAME --output table
az network private-endpoint list --resource-group $RG --output table

Restrict the storage account's public network access¶

With the private endpoint and private DNS zone in place, close the storage account's public endpoint so it is reachable only through the private path.

az storage account update --resource-group $RG --name $STORAGE_NAME --public-network-access Disabled --default-action Deny

Verification¶

• az webapp vnet-integration list shows the expected VNet and delegated subnet.
• az network private-endpoint list shows private endpoints in a healthy state.
• The app can use DefaultAzureCredential to reach Storage and Key Vault without secrets.
• Storage and Key Vault hostnames resolve through the linked private DNS zones.

Troubleshooting¶

Private endpoint exists but the app still uses public resolution¶

• Confirm the private DNS zones are linked to the same VNet used for App Service integration.
• Verify the private endpoint DNS zone groups were created successfully.

Managed identity requests return 403¶

• Wait a few minutes for RBAC propagation.
• Verify the role assignments target the correct principalId and resource scope.

App cannot connect after VNet integration¶

• Confirm the integration subnet is delegated to Microsoft.Web/serverFarms.
• Review NSG and route table rules if your VNet uses custom egress controls.

Run It in the Portal¶

Portal view: Access Restrictions blade (before-state inbound access configuration)¶

Purpose: Show the inbound access state before any access restriction is added.

Look for: Public network access shows Enabled (using default behavior), Unmatched rule action is Allow, and the only rule is Allow all with priority 2147483647.

Expected result: With no custom rules, the displayed default-endpoint policy admits any source until you add rules or disable public network access. This is a configuration reading, not a measured reachability test.

The Access Restrictions blade is the Portal surface that displays the access configuration of this app while you work through the recipe's VNet integration, managed identity, and storage private endpoint steps. In the visible default state, Public network access is enabled with default behavior and the rules table contains only Allow all, so this screenshot works as a before-state reminder that those outbound/private-connectivity steps do not by themselves change the displayed inbound configuration. The blade shows configuration, not whether any client can reach the app: a private endpoint, DNS, routing and the applicable main-site or SCM policy (depending on the target and ingress path) also decide that, and the effective-policy reading is in Private Endpoint and Access Restriction Decisions. Use it only as a before-state configuration reference, not as evidence that the recipe itself has already added access-restriction rules.

See Also¶

• VNet Integration
• Private Endpoints
• Managed Identity
• Key Vault References
• App Service to Azure Storage connectivity

Sources¶

• Integrate your app with an Azure virtual network
• Use private endpoints for Azure App Service apps
• Use managed identities for App Service and Azure Functions
• Tutorial: Connect to Azure SQL Database from Node.js on App Service without secrets using a managed identity