Forum Discussion

Jason Woodfield's avatar
Jason Woodfield
Copper Contributor
Oct 10, 2018

Azure App Service Environments Internal and External access

I am looking to deploy a internal Intranet site and an external internet site and i would like to try and use Azure Web Apps to do this. The intranet should only be accessible from internal networks however the public facing website will obviously need to be accessible from anywhere. 

 

At the moment it is looking like i would need to deploy an App Service Environment and host the intranet site in there but it would be nice if i could then create a separate app and host that from within the same ASE. I suspect i could do it if i put a web application gateway on the network with a public IP but i want to try and avoid that as it is additional management and overhead. 

 

How have others done this? Do you just host Web Apps using multiple app service plans?

App Services
azure

3 Replies

  • OwenLanty's avatar
    OwenLanty
    Copper Contributor
    Jul 24, 2026

    You do not need to place both applications in one App Service Environment. Keep the intranet app private by using a private endpoint and private DNS, then host the public site in a normal multitenant App Service plan with its own public endpoint. This gives each site the correct exposure model and avoids making the public app depend on the internal ASE's networking design.

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Jul 22, 2026

    You can host both internal (intranet) and external (internet-facing) sites using Azure App Service Environments (ASE v3), but required to choose the right deployment type: an Internal ASE (ILB) for private apps accessible only via VPN/ExpressRoute, and an External ASE for public apps with a public IP. Both can run multiple apps in separate App Service Plans within the same ASE, learn.microsoft.com/en-us/azure/app-service/environment/overview

  • Jamony's avatar
    Jamony
    MCT
    Jul 01, 2026

    Hi, I’d normally keep the internal and public workloads separated at the network boundary. An internal ASE is a good fit for the intranet app, but for the public-facing app I’d usually use a regular App Service or a separate public-facing setup unless there is a strong reason to place both in the ASE. You can front things with Application Gateway or Front Door depending on the design, but mixing internal-only and public entry points in the same environment can make the network and security model harder to reason about.