Inbound private endpoint for Standard v2 tier of Azure API Management

Standard v2 was announced in general availability on April 1st, 2024. Customers can now configure an inbound private endpoint (preview) for your API Management Standard v2 instance to allow clients in your private network to securely access the API Management gateway over Azure Private Link.

The private endpoint uses an IP address from an Azure virtual network in which it's hosted. Network traffic between a client on your private network and API Management traverses over the virtual network and a Private Link on the Microsoft backbone network, eliminating exposure from the public internet. Further, you can configure custom DNS settings or an Azure DNS private zone to map the API Management hostname to the endpoint's private IP address.

Inbound private endpoint

With a private endpoint and Private Link, you can:

• Create multiple Private Link connections to an API Management instance.
• Use the private endpoint to send inbound traffic on a secure connection.
• Use policy to distinguish traffic that comes from the private endpoint.
• Limit incoming traffic only to private endpoints, preventing data exfiltration.
• Combine with outbound virtual network integration to provide end-to-end network isolation of your API Management clients and backend services.

Preview limitations

Today, only the API Management instance’s Gateway endpoint supports inbound private link connections. In addition, each API management instance can support at most 100 private link connections.

To participate in the preview and add an inbound private endpoint to your Standard v2 instance, you must complete a request form. The Azure API Management team will review your request and respond via email within five business days.

Learn more

• API Management v2 tiers FAQ
• API Management v2 tiers documentation
• API Management overview documentation