Private Network Deployment¶

Use this recipe when the simple public az webapp up flow is no longer enough and your Flask app needs outbound private connectivity plus identity-based access to Azure services.

flowchart TD
    INET[Internet] --> WA[Web App\nApp Service Linux\nPython 3.11]

    subgraph VNET[Virtual Network]
        INT[Integration Subnet]
        PE[Private Endpoint Subnet]
    end

    WA --> INT
    PE --> ST[Storage Account]
    WA -.-> MI[System-Assigned Managed Identity]
    MI -.-> ENTRA[Microsoft Entra ID]

    style WA fill:#0078d4,color:#fff

Prerequisites¶

• Completed 01 - Local Run
• Existing Azure subscription and Azure CLI authentication
• App Service app already created or ready to create in a supported tier for VNet integration
• Permissions to create VNets, subnets, private endpoints, storage accounts, and managed identity assignments

Main Content¶

Step 1: Prepare deployment variables¶

RG="rg-flask-tutorial"
LOCATION="koreacentral"
APP_NAME="app-flask-tutorial-abc123"
VNET_NAME="vnet-flask-tutorial"
INTEGRATION_SUBNET_NAME="snet-appsvc-integration"
PE_SUBNET_NAME="snet-private-endpoints"
STORAGE_NAME="stflasktutorialabc123"

Step 2: Create the VNet and delegated integration subnet¶

az network vnet create --resource-group $RG --name $VNET_NAME --location $LOCATION --address-prefixes 10.0.0.0/16
az network vnet subnet create --resource-group $RG --vnet-name $VNET_NAME --name $INTEGRATION_SUBNET_NAME --address-prefixes 10.0.1.0/24 --delegations Microsoft.Web/serverFarms

Step 3: Create the private endpoint subnet¶

az network vnet subnet create --resource-group $RG --vnet-name $VNET_NAME --name $PE_SUBNET_NAME --address-prefixes 10.0.2.0/24 --disable-private-endpoint-network-policies true

Step 4: Integrate the web app with the VNet¶

az webapp vnet-integration add --resource-group $RG --name $APP_NAME --vnet $VNET_NAME --subnet $INTEGRATION_SUBNET_NAME

Step 5: Assign managed identity to the web app¶

az webapp identity assign --resource-group $RG --name $APP_NAME

Step 6: Create a private endpoint for Storage¶

az storage account create --resource-group $RG --name $STORAGE_NAME --location $LOCATION --sku Standard_LRS --kind StorageV2
STORAGE_ID="$(az storage account show --resource-group $RG --name $STORAGE_NAME --query id --output tsv)"
az network private-endpoint create --resource-group $RG --name pe-storage-blob --vnet-name $VNET_NAME --subnet $PE_SUBNET_NAME --private-connection-resource-id $STORAGE_ID --group-id blob --connection-name pe-storage-blob-connection

Step 7: Create a private DNS zone and link it to the VNet¶

A private endpoint only helps if the app's DNS resolves the standard storage FQDN to the private IP. Create the privatelink.blob.core.windows.net zone, link it to the VNet, and wire the private endpoint to it with a DNS zone group.

az network private-dns zone create --resource-group $RG --name "privatelink.blob.core.windows.net"
az network private-dns link vnet create --resource-group $RG --zone-name "privatelink.blob.core.windows.net" --name link-blob --virtual-network $VNET_NAME --registration-enabled false
az network private-endpoint dns-zone-group create --resource-group $RG --endpoint-name pe-storage-blob --name pe-storage-blob-zonegroup --private-dns-zone "privatelink.blob.core.windows.net" --zone-name blob

Step 8: Restrict the storage account's public network access¶

With the private path in place, close the public endpoint so the account is reachable only through the private endpoint.

az storage account update --resource-group $RG --name $STORAGE_NAME --public-network-access Disabled --default-action Deny

Verification¶

az webapp vnet-integration list --resource-group $RG --name $APP_NAME --output table
az webapp identity show --resource-group $RG --name $APP_NAME --output json
az network private-endpoint list --resource-group $RG --output table

Troubleshooting¶

• If VNet integration fails, confirm the integration subnet is delegated to Microsoft.Web/serverFarms.
• If private endpoint creation fails, confirm the private endpoint subnet has network policies disabled.
• If managed identity authentication fails, confirm the identity is enabled and RBAC or access policies are configured on the target service.

Run It in the Portal¶

Portal view: Access Restrictions blade (before-state inbound access configuration)¶

Purpose: Show the inbound access state before any access restriction is added.

Look for: Public network access shows Enabled (using default behavior), Unmatched rule action is Allow, and the only rule is Allow all with priority 2147483647.

Expected result: With no custom rules, the displayed default-endpoint policy admits any source until you add rules or disable public network access. This is a configuration reading, not a measured reachability test.

The Access Restrictions blade is the Portal surface that displays the access configuration of this app while you work through the recipe's VNet integration, managed identity, and storage private endpoint steps. In the visible default state, Public network access is enabled with default behavior and the rules table contains only Allow all, so this screenshot works as a before-state reminder that those outbound/private-connectivity steps do not by themselves change the displayed inbound configuration. The blade shows configuration, not whether any client can reach the app: a private endpoint, DNS, routing and the applicable main-site or SCM policy (depending on the target and ingress path) also decide that, and the effective-policy reading is in Private Endpoint and Access Restriction Decisions. Use it only as a before-state configuration reference, not as evidence that the recipe itself has already added access-restriction rules.

See Also¶

• VNet Integration
• Private Endpoints
• Managed Identity
• App Service to Azure Storage connectivity
• 02 - First Deployment to Azure App Service

Sources¶

• Integrate your app with an Azure virtual network (Microsoft Learn)
• Use private endpoints for Azure App Service apps (Microsoft Learn)
• Use managed identities for App Service (Microsoft Learn)
• Quickstart: Deploy a Python web app (Microsoft Learn)