Configure and verify Vnet in Azure

Let's prepare below to ensure traffic between App Services and Azure SQL flows through the VNet:

1. VNet Integration for App Services
• Use Regional VNet Integration (not Gateway-required) for each App Service.
• Confirm that each App Service is integrated with the same VNet and subnet.
2. Private Endpoint for Azure SQL
• Create a Private Endpoint for your Azure SQL Database.
• This ensures traffic from App Services to SQL stays within the VNet and avoids public IP routing.
3. Private DNS Zone
• Link a Private DNS Zone to your VNet for privatelink.database.windows.net.
• This allows App Services to resolve the SQL server name to its private IP.
4. Firewall Rules
• On the SQL server, disable “Allow Azure services” and only allow traffic from your VNet.

For Monitor and Verify VNet Traffic

1. Network Watcher
• Use Network Watcher > Connection Monitor to track traffic between App Services and SQL.
• You can set up probes to verify connectivity and latency.
2. NSG Flow Logs
• Enable Network Security Group (NSG) Flow Logs on the subnet.
• This records traffic flow and can be analyzed in Azure Monitor or Storage.
3. Azure Monitor Metrics
• Use App Service diagnostics to check outbound traffic patterns.
• SQL metrics can show connection sources—look for private IPs from your VNet.
4. Azure Log Analytics
• Connect your resources to a Log Analytics workspace.
• Use KQL queries to inspect traffic and confirm private endpoint usage.