Implementing platform service network security

Services such as Azure Storage and Azure Key Vault cannot be deployed into a customer-managed Azure virtual network. At the time of writing, only 29 platform services can be deployed to a customer-managed virtual network. Additionally, deploying supported services in a private network can be expensive. For example, deploying an Azure App Service into a private network with App Service Environment costs more than deploying a normal App Service.

When deploying platform services outside of customer-managed virtual networks, there are options available for controlling network connections to the services in Azure. These options include the platform service firewall, private endpoints, and service endpoints (see Figure 10.1):

Figure 10.1 – Options for controlling inbound network connections to platform services in Azure

Let’s get started with the platform service firewall option!

Note

For...