Designing and Implementing Platform Service Connectivity

Azure offers various platform services, such as Azure SQL Database, Azure Storage, Azure Key Vault, and Azure App Service, that are widely used by organizations. These services come with several advantages, such as easy deployment, automatic scaling, built-in backups, and high availability. While it is advisable to deploy platform services in a customer-managed virtual network for better control over network traffic, this may not always be possible, mainly due to technical limitations. When deploying platform services outside of customer-managed virtual networks, there are three main options available for controlling network connections to the services in Azure. This chapter will provide you with a clear understanding of these three options. It will also guide you in determining the appropriate option to use based on your specific use case. By the end of this chapter, you will have a good understanding of the following:

...

Technical requirements

To follow along with the instructions in this chapter, you will need the following:

• A PC with an internet connection
• An Azure subscription

Implementing platform service network security

Services such as Azure Storage and Azure Key Vault cannot be deployed into a customer-managed Azure virtual network. At the time of writing, only 29 platform services can be deployed to a customer-managed virtual network. Additionally, deploying supported services in a private network can be expensive. For example, deploying an Azure App Service into a private network with App Service Environment costs more than deploying a normal App Service.

When deploying platform services outside of customer-managed virtual networks, there are options available for controlling network connections to the services in Azure. These options include the platform service firewall, private endpoints, and service endpoints (see Figure 10.1):

Figure 10.1 – Options for controlling inbound network connections to platform services in Azure

Let’s get started with the platform service firewall option!

Note

For...

Summary

In this chapter, we provided insights into the options available for managing network connections to Azure platform services. We discussed and implemented a platform service firewall and exceptions, a service endpoint, and a private endpoint. This chapter has provided you with the knowledge and skills necessary to control network connections to Azure platform services effectively. This information is also crucial for the AZ-700 – Azure Network Engineer certification exam.

In the final chapter of this book, we will focus on network monitoring in Azure. Thank you, and we look forward to seeing you there!

Further reading

Refer to the following links for more information about the topics covered in this chapter:

• Virtual Network service endpoints: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
• Private Link documentation: https://learn.microsoft.com/en-us/azure/private-link/