%3CLINGO-SUB%20id%3D%22lingo-sub-1613047%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1613047%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F91611%22%20target%3D%22_blank%22%3E%40Michael%20Collier%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENice%20post!%20I%20managed%20to%20make%20the%20Azure%20Function%20work%20with%20Private%20Endpoints%20for%20the%20backing%20Storage%20Accounts%20with%20the%20following%20steps%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECreated%20service%20endpoints%20for%20each%20service%20of%20the%20backing%20SA%20(blob%2C%20table%2C%20queue%20and%20files)%3C%2FLI%3E%0A%3CLI%3EDuring%20Function%20deployment%20network%20restrictions%20are%20disabled%20for%20the%20backing%20SA%3C%2FLI%3E%0A%3CLI%3EAfter%20successful%20deployment%20network%20restrictions%20are%20enabled.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20updated%20the%20post%2C%20I%20wrote%20back%20in%20May%2C%20with%20some%20notes%20and%20code%20%3CA%20href%3D%22https%3A%2F%2Fcarlos.mendible.com%2F2020%2F05%2F18%2Fazure-functions-use-blob-trigger-with-private-endpoint%2F%23update-2020-08-25%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E%2C%20where%20I'm%20using%20the%20same%20storage%20account%20for%20the%20backing%20services%20and%20also%20to%20hold%202%20containers%20used%20by%20the%20Function%20to%20simply%20copy%20form%20one%20to%20another.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBest%20Regards%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1610592%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1610592%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F91611%22%20target%3D%22_blank%22%3E%40Michael%20Collier%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20this%20interesting%20post.%20Is%20there%20any%20change%20(compared%20to%20what%20you%20wrote)%20regarding%20the%20private%20DNS%20zones%3F%20When%20enabling%20private%20link%20from%20the%20portal%2C%20a%20private%20DNS%20zone%20is%20indeed%20created%20but%20it%20doesn't%20create%20any%20ALIAS%20record.%20Trying%20to%20add%20one%20manually%20fails%20as%20the%20zone%20tells%20it%20already%20exists%20(but%20is%20not%20visible%20in%20any%20case)%20and%20indeed%2C%20resolving%20the%20public%20DNS%20from%20within%20the%20VNET%20works%20although%20no%20ALIAS%20record%20is%20visible.%20Any%20clue%20on%20that%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%5Bedit%5D%3C%2FP%3E%0A%3CP%3EOk%20realized%20that%20the%20CNAME%20is%20automatically%20created%20and%20out%20of%20scope%20for%20the%20Cloud%20consumer.%3C%2FP%3E%0A%3CP%3E%5B%2Fedit%5D%3C%2FP%3E%0A%3CP%3EBest%20Regards%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1426615%22%20slang%3D%22en-US%22%3EConnect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1426615%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20enterprises%20continue%20to%20adopt%20serverless%20(and%20Platform-as-a-Service%2C%20or%20PaaS)%20solutions%2C%20they%20often%20need%20a%20way%20to%20integrate%20with%20existing%20resources%20on%20a%20virtual%20network.%20These%20existing%20resources%20could%20be%20databases%2C%20file%20storage%2C%20message%20queues%20or%20event%20streams%2C%20or%20REST%20APIs.%20In%20doing%20so%2C%20those%20interactions%20need%20to%20take%20place%20within%20the%20virtual%20network.%20Until%20relatively%20recently%2C%20combining%20serverless%2FPaaS%20offerings%20with%20traditional%20network%20access%20restrictions%20was%20complex%2C%20if%20not%20nearly%20impossible.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWith%20the%20introduction%20of%20Azure%20Virtual%20Network%20service%20endpoints%20and%20private%20endpoints%2C%20it%E2%80%99s%20becoming%20easier%20for%20enterprises%20to%20realize%20the%20benefits%20of%20serverless%2C%20while%20also%20complying%20with%20necessary%20virtual%20network%20access%20controls.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20post%20will%20detail%20how%20to%20configure%20an%20Azure%20Function%20to%20work%20with%20Azure%20resources%20using%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fprivate-link%2Fprivate-endpoint-overview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eprivate%20endpoints%3C%2FA%3E.%20Private%20endpoints%20ensure%20that%20the%20designated%20resources%20are%20accessible%20only%20via%20the%20specified%20virtual%20network.%20The%20Azure%20Function%20app%20will%20communicate%20with%20designated%20resources%20using%20a%20resource-specific%20private%20IP%20address%20(e.g.%2010.100.0%2F24%20address%20space).%20This%20provides%20an%20additional%20level%20of%20network-based%20security%20and%20control.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20sample%20shown%20in%20this%20post%20discusses%20the%20following%20key%20concepts%20necessary%20to%20use%20private%20endpoints%20with%20Azure%20Functions%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EAzure%20Function%20with%20blob%20trigger%20and%20CosmosDB%20output%20binding%3C%2FLI%3E%0A%3CLI%3EAzure%20Function%20Premium%20plan%20with%20Virtual%20Network%20Integration%20enabled%3C%2FLI%3E%0A%3CLI%3EVirtual%20network%3C%2FLI%3E%0A%3CLI%3EConfiguring%20private%20endpoints%20for%20Azure%20resources%3CUL%3E%0A%3CLI%3EAzure%20Storage%20private%20endpoints%3C%2FLI%3E%0A%3CLI%3EAzure%20Cosmos%20DB%20private%20endpoint%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EUsing%20private%20Azure%20DNS%20zones%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EAdditionally%2C%20the%20sample%20uses%20an%20Azure%20VM%20and%20Azure%20Bastion%20in%20order%20to%20access%20Azure%20resources%20within%20the%20virtual%20network.%20The%20VM%20and%20Azure%20Bastion%20setup%20is%20not%20discussed%20in%20this%20post.%20If%20you%20want%20to%20learn%20more%20about%20using%20Azure%20Bastion%2C%20please%20refer%20to%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fbastion%2Fbastion-overview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fbastion%2Fbastion-overview%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPlease%20view%20the%20full%20sample%20and%20related%20artifacts%20on%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsamples%2Fazure-samples%2Fazure-functions-private-endpoints%2Fconnect-to-private-endpoints-with-azure-functions%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft%20Code%20Samples%20site%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%20id%3D%22toc-hId--1326612692%22%3EArchitecture%20Overview%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20following%20diagram%20shows%20the%20high-level%20architecture%20of%20the%20solution%20to%20be%20created%3A%3C%2FP%3E%0A%3CP%20class%3D%22lia-align-center%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22high-level-architecture.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F195356i86F8C973F23F1487%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22high-level-architecture.jpg%22%20alt%3D%22high-level-architecture.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH2%20id%3D%22deployment%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%20id%3D%22toc-hId-1160900141%22%3EDeployment%3C%2FH2%3E%0A%3CP%3EIn%20order%20to%20get%20started%20with%20this%20sample%2C%20you%E2%80%99ll%20need%20an%20Azure%20subscription.%20If%20you%20don%E2%80%99t%20have%20one%2C%20you%20can%20get%20a%20free%20Azure%20account%20at%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Ffree%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Ffree%2F%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%20id%3D%22toc-hId-1851461615%22%3EPrerequisites%3C%2FH3%3E%0A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fcli%2Fazure%2Finstall-azure-cli%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20CLI%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-run-local%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Function%20Core%20Tools%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22deploy-the-resource-manager-template%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%20id%3D%22toc-hId-44007152%22%3EDeploy%20the%20Resource%20Manager%20template%3C%2FH3%3E%0A%3CP%3EAn%20Azure%20Resource%20Manager%20(ARM)%20template%20is%20available%20to%20provision%20the%20necessary%20Azure%20resources.%20The%20template%20will%20also%20create%20the%20application%20settings%20needed%20by%20the%20Azure%20Function%20sample%20code.%20The%20Azure%20CLI%20can%20be%20used%20to%20deploy%20the%20template%3A%3C%2FP%3E%0A%3CDIV%20class%3D%22highlight%22%3E%3CPRE%20class%3D%22lia-code-sample%20language-bash%22%3E%3CCODE%3EresourceGroupName%3D%22functions-private-endpoints%22%0Alocation%3D%22eastus%22%0Anow%3D%60date%20%2B%25Y%25m%25d-%25H%25M%25S%60%0AdeploymentName%3D%22azuredeploy-%24now%22%0A%0Aecho%20%22Creating%20resource%20group%20'%24resourceGroupName'%20in%20region%20'%24location'%20.%20.%20.%22%0Aaz%20group%20create%20--name%20%24resourceGroupName%20--location%20%24location%0A%0Aecho%20%22Deploying%20main%20template%20.%20.%20.%22%0Aaz%20deployment%20group%20create%20-g%20%24resourceGroupName%20--template-file%20azuredeploy.json%20--parameters%20azuredeploy.parameters.json%20--name%20%24deploymentName%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FDIV%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22deploy-the-code%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%20id%3D%22toc-hId--1763447311%22%3EDeploy%20the%20code%3C%2FH3%3E%0A%3CP%3EThe%20function%20can%20be%20published%20manually%20by%20using%20the%20Azure%20Function%20Core%20Tools%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-bash%22%3E%3CCODE%3Efunc%20azure%20functionapp%20publish%20%3CFUNCTION-APP-NAME%3E%3C%2FFUNCTION-APP-NAME%3E%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22virtual-network%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%20id%3D%22toc-hId--1773950415%22%3EVirtual%20Network%3C%2FH2%3E%0A%3CP%3EOne%20of%20the%20first%20components%20to%20set%20up%20is%20the%20virtual%20network.%20Nearly%20all%20other%20Azure%20services%20in%20this%20sample%20are%20either%20provisioned%20into%2C%20or%20integrated%20with%2C%20the%20virtual%20network.%20After%20all%2C%20this%20sample%20is%20about%20using%20private%20endpoints%2C%20and%20private%20endpoints%20go%20along%20with%20a%20virtual%20network%20(can%E2%80%99t%20have%20one%20without%20the%20other).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20sample%20uses%20four%20subnets%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ESubnet%20for%20Azure%20Function%20virtual%20network%20integration.%20This%20subnet%20is%20delegated%20to%20the%20function.%3C%2FLI%3E%0A%3CLI%3ESubnet%20for%20private%20endpoints.%20Private%20IP%20addresses%20are%20allocated%20from%20this%20subnet.%3C%2FLI%3E%0A%3CLI%3ESubnet%20for%20the%20virtual%20machine.%20The%20template%20creates%20a%20VM%20which%20is%20placed%20within%20this%20subnet.%3C%2FLI%3E%0A%3CLI%3ESubnet%20for%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fbastion%2Fbastion-create-host-portal%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Bastion%20host%3C%2FA%3E.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%20id%3D%22toc-hId--1083388941%22%3EVirtual%20Network%20(VNet)%20Integration%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20order%20for%20the%20function%20to%20access%20resources%20within%20the%20virtual%20network%2C%20VNet%20Integration%20is%20needed.%20The%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-networking-options%23matrix-of-networking-features%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ematrix%20of%20Azure%20Functions%20networking%20features%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eshows%20that%20there%20are%20currently%20three%20options%20for%20VNet%20Integration%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EAzure%20Functions%20Premium%20plan%3C%2FLI%3E%0A%3CLI%3EAzure%20App%20Service%20Plan%3C%2FLI%3E%0A%3CLI%3EAzure%20App%20Service%20Environment%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%20data-unlink%3D%22true%22%3EAn%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-premium-plan%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Function%20Premium%20plan%3C%2FA%3E%20is%20used%20in%20this%20sample.%20By%20using%20an%20Azure%20Function%20Premium%20plan%20with%20VNet%20Integration%20enabled%2C%20the%20function%20is%20able%20to%20access%20Azure%20Storage%20and%20CosmosDB%20via%20the%20configured%20private%20endpoints.%3C%2FP%3E%0A%3CP%20data-unlink%3D%22true%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPlease%20refer%20to%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-networking-options%23regional-virtual-network-integration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eofficial%20documentation%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Efor%20more%20information%20on%20using%20Azure%20Functions%20with%20virtual%20network%20integration.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%20id%3D%22toc-hId-1404123892%22%3EAzure%20Function%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20function%20used%20in%20this%20sample%20is%20based%20on%20a%20simplified%20concept%20of%20processing%20data%20from%20CSV%20files.%26nbsp%3B%20At%20a%20high%20level%2C%20the%20function%20logic%20is%20as%20follows%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ETrigger%20on%20a%20new%20CSV-formatted%20file%20being%20available%20in%20a%20specific%20Azure%20Storage%20blob%20container%3C%2FLI%3E%0A%3CLI%3EConvert%20the%20CSV%20file%20to%20JSON%3C%2FLI%3E%0A%3CLI%3ESave%20the%20JSON%20document%20to%20CosmosDB%20via%20an%20output%20binding%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20function%20is%20invoked%20via%20an%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-bindings-storage-blob-trigger%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Storage%20blob%20trigger%3C%2FA%3E.%20The%20storage%20account%20used%20by%20the%20blob%20trigger%20is%20configured%20with%20a%20private%20endpoint.%20The%20function%20assumes%20the%20file%20is%20in%20a%20CSV%20format%2C%20and%20then%20converts%20the%20CSV%20content%20to%20JSON.%20The%20resulting%20JSON%20document%20is%20saved%20to%20an%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-bindings-cosmosdb-v2-output%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20CosmosDB%20collection%20via%20an%20output%20binding%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3E%5BFunctionName(%22WidgetOrdersFunction%22)%5D%0Apublic%20static%20async%20Task%20ProcessOrderDataFiles(%0A%20%20%20%20%5BBlobTrigger(%22%25ContainerName%25%2F%7BblobName%7D%22%2C%20Connection%20%3D%20%22WidgetsAzureStorageConnection%22)%5D%20Stream%20myBlobStream%2C%0A%20%20%20%20string%20blobName%2C%0A%20%20%20%20%5BCosmosDB(%0A%20%20%20%20%20%20%20%20databaseName%3A%20%22%25CosmosDbName%25%22%2C%0A%20%20%20%20%20%20%20%20collectionName%3A%20%22%25CosmosDbCollectionName%25%22%2C%0A%20%20%20%20%20%20%20%20ConnectionStringSetting%20%3D%20%22CosmosDBConnection%22)%5D%20IAsyncCollector%3CSTRING%3E%20items%2C%0A%20%20%20%20ILogger%20logger)%0A%7B%0A%20%20%20%20logger.LogInformation(%24%22C%23%20Blob%20trigger%20function%20processed%20blob%20of%20name%20'%7BblobName%7D'%20with%20size%20of%20%7BmyBlobStream.Length%7D%20bytes%22)%3B%0A%0A%20%20%20%20var%20jsonObject%20%3D%20await%20ConvertCsvToJsonAsync(myBlobStream)%3B%0A%0A%20%20%20%20foreach%20(var%20item%20in%20jsonObject)%0A%20%20%20%20%7B%0A%20%20%20%20%20%20%20%20await%20items.AddAsync(JsonConvert.SerializeObject(item))%3B%0A%20%20%20%20%7D%0A%7D%3C%2FSTRING%3E%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%20id%3D%22toc-hId--403330571%22%3E%3CSPAN%20style%3D%22color%3A%20inherit%3B%20font-family%3A%20inherit%3B%20font-size%3A%2018px%3B%22%3EAzure%20Function%20Configuration%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3EThere%20are%20a%20few%20important%20details%20about%20the%20configuration%20of%20the%20function.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH4%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%20id%3D%22toc-hId-287230903%22%3ERun%20from%20Package%3C%2FH4%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20data-unlink%3D%22true%22%3EThe%20function%20is%20configured%20to%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Frun-functions-from-deployment-package%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Erun%20from%20a%20deployment%20package%3C%2FA%3E.%20As%20such%2C%20the%20package%20is%20persisted%20in%20an%20Azure%20File%20share%20referenced%20by%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-app-settings%23website_contentazurefileconnectionstring%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EWEBSITE_CONTENTAZUREFILECONNECTIONSTRING%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eapplication%20setting.%20Please%20review%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Esection%20below%20on%20Azure%20Storage%20Private%20Endpoints%26nbsp%3Bfor%20why%20this%20is%20important%20in%20this%20scenario.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%20id%3D%22toc-hId--418435680%22%3EVirtual%20Network%20Triggers%3C%2FH3%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-networking-options%23premium-plan-with-virtual-network-triggers%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EVirtual%20network%20trigger%20support%20must%20be%20enabled%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ein%20order%20for%20the%20function%20to%20trigger%20against%20resources%20using%20a%20private%20endpoint.%20Virtual%20network%20trigger%20support%20can%20be%20enabled%20via%20the%20Azure%20portal%2C%20the%20Azure%20CLI%2C%20or%20via%20an%20ARM%20template%20(as%20done%20in%20this%20sample).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-json%22%3E%3CCODE%3E%7B%0A%20%20%20%20%22type%22%3A%20%22config%22%2C%0A%20%20%20%20%22name%22%3A%20%22web%22%2C%0A%20%20%20%20%22apiVersion%22%3A%20%222019-08-01%22%2C%0A%20%20%20%20%22dependsOn%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%22%5BresourceId('Microsoft.Web%2Fsites'%2C%20variables('functionAppName'))%5D%22%2C%0A%20%20%20%20%20%20%20%20%22%5BresourceId('Microsoft.Network%2FvirtualNetworks'%2C%20variables('vnetName'))%5D%22%0A%20%20%20%20%5D%2C%0A%20%20%20%20%22properties%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22functionsRuntimeScaleMonitoringEnabled%22%3A%20true%0A%20%20%20%20%7D%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EView%20the%20full%20ARM%20template%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure-Samples%2FAzure-Functions-Private-Endpoints%2Fblob%2Fmaster%2Ftemplate%2Fazuredeploy.json%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%20id%3D%22toc-hId-2069077153%22%3EAzure%20DNS%20Private%20Zones%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20using%20VNet%20Integration%2C%20the%20function%20app%20uses%20the%20same%20DNS%20server%20that%20is%20configured%20for%20the%20virtual%20network.%20To%20work%20with%20a%20private%20endpoint%2C%20the%20default%20configuration%20needs%20to%20be%20overridden.%20In%20order%20to%20make%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-networking-options%23azure-dns-private-zones%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ecalls%20to%20a%20resource%20using%20a%20private%20endpoint%3C%2FA%3E%2C%20it%20is%20necessary%20to%20integrate%20with%20Azure%20DNS%20Private%20Zones.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPrivate%20endpoints%20automatically%20create%20Azure%20DNS%20Private%20Zones.%20The%20Azure%20DNS%20Private%20Zone%20contains%20the%20details%20on%20how%20to%20route%20requests%20to%20the%20private%20IP%20address%20for%20the%20designated%20Azure%20service.%20Therefore%2C%20it%20is%20necessary%20to%20configure%20the%20app%20to%20use%20a%20specific%20Azure%20DNS%20server%2C%20and%20also%20route%20all%20network%20traffic%20into%20the%20virtual%20network.%20This%20is%20accomplished%20by%20setting%20the%20following%20application%20settings%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTHEAD%3E%0A%3CTR%3E%0A%3CTH%3EName%3C%2FTH%3E%0A%3CTH%3EValue%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3C%2FTHEAD%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%3EWEBSITE_DNS_SERVER%3C%2FTD%3E%0A%3CTD%3E168.63.129.16%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EWEBSITE_VNET_ROUTE_ALL%3C%2FTD%3E%0A%3CTD%3E1%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22azure-storage-private-endpoints%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%20id%3D%22toc-hId-132539971%22%3EAzure%20Storage%20Private%20Endpoints%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20data-unlink%3D%22true%22%3EAzure%20Functions%20requires%20an%20Azure%20Storage%20account%20for%20persisting%20runtime%20metadata%20and%20metadata%20related%20to%20various%20triggers.%20The%20official%20Microsoft%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-networking-options%23restrict-your-storage-account-to-a-virtual-network%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Edocumentation%20indicates%3C%2FA%3E%20that%20it%20is%20currently%20not%20possible%20to%20use%20Azure%20Functions%20with%20a%20storage%20account%20which%20uses%20virtual%20network%20restrictions.%20While%20that%E2%80%99s%20mostly%20true%2C%20there%20is%20a%20workaround.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20workaround%20being%20that%20it%20is%20possible%20to%20put%20virtual%20network%20restrictions%20on%20the%20Azure%20storage%20account%20referenced%20via%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-app-settings%23azurewebjobsstorage%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzureWebJobsStorage%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eapplication%20setting.%20However%2C%20if%20that%20is%20done%2C%20then%20a%20separate%20storage%20account%20-%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CEM%3Eone%20without%20network%20restrictions%3C%2FEM%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E-%20is%20needed.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20other%20(without%20network%20restrictions)%20storage%20account%20needs%20to%20be%20referenced%20via%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-app-settings%23website_contentazurefileconnectionstring%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EWEBSITE_CONTENTAZUREFILECONNECTIONSTRING%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eapplication%20setting.%20It%20is%20this%20storage%20account%20that%20will%20contain%20an%20Azure%20File%20share%20used%20to%20persist%20the%20function%E2%80%99s%20application%20code.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFurthermore%2C%20for%20this%20sample%2C%20a%20third%20storage%20account%20is%20used.%20This%20third%20storage%20account%20is%20used%20by%20the%20sample%20application%20code%20-%20it%E2%80%99s%20where%20the%20CSV%20file%20will%20be%20placed.%20The%20Function%20blob%20trigger%20will%20pick%20up%20this%20file%20and%20the%20function%20will%20do%20work%20against%20it.%20This%20storage%20account%20will%20also%20use%20a%20private%20endpoint.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20sample%20will%20use%20three%20Azure%20storage%20related%20application%20settings%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTHEAD%3E%0A%3CTR%3E%0A%3CTH%3EName%3C%2FTH%3E%0A%3CTH%3EDescription%3C%2FTH%3E%0A%3CTH%3EUses%20a%20Private%20Endpoint%3F%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3C%2FTHEAD%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%3E%3CSPAN%3EWidgetsAzureStorageConnection%3C%2FSPAN%3E%3C%2FTD%3E%0A%3CTD%3EThe%20connection%20string%20for%20an%20Azure%20Storage%20account%20used%20by%20the%20function%E2%80%99s%20blob%20trigger.%3C%2FTD%3E%0A%3CTD%3EYes%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-app-settings%23azurewebjobsstorage%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzureWebJobsStorage%3C%2FA%3E%3C%2FTD%3E%0A%3CTD%3EThe%20connection%20string%20for%20an%20Azure%20Storage%20account%20required%20by%20Azure%20Functions.%3C%2FTD%3E%0A%3CTD%3EYes%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-functions%2Ffunctions-app-settings%23website_contentazurefileconnectionstring%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EWEBSITE_CONTENTAZUREFILECONNECTIONSTRING%3C%2FA%3E%3C%2FTD%3E%0A%3CTD%3EThe%20connection%20string%20references%20an%20Azure%20Storage%20account%20which%20contains%20an%20Azure%20File%20share%20used%20to%20store%20the%20application%20content%2Fcode.%3C%2FTD%3E%0A%3CTD%3ENo%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20using%20private%20endpoints%20for%20Azure%20Storage%2C%20it%20is%20necessary%20to%20create%20a%20private%20endpoint%20for%20each%20Azure%20Storage%20service%20(table%2C%20blob%2C%20queue%2C%20or%20file).%20Therefore%2C%20this%20samples%20sets%20up%205%20private%20endpoints%20related%20to%20Azure%20Storage.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EFour%20private%20endpoints%20related%20to%20each%20of%20the%20services%20referenced%20by%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CEM%3EAzureWebJobsStorage%3C%2FEM%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eapplication%20setting.%3C%2FLI%3E%0A%3CLI%3EOne%20private%20endpoint%20for%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3Eblob%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Estorage%20referenced%20by%20the%3CEM%3E%20WidgetsAzureStorageConnection%26nbsp%3B%3C%2FEM%3Eapplication%20setting.%20This%20is%20the%20only%20private%20endpoint%20related%20to%20the%3CEM%3E%20WidgetsAzureStorageConnection%26nbsp%3B%3C%2FEM%3Eapplication%20setting.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%20id%3D%22toc-hId--1674914492%22%3EAzure%20Cosmos%20DB%20Private%20Endpoints%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20mentioned%20previously%2C%20a%20CosmosDB%20output%20binding%20is%20used%20to%20save%20data%20to%20a%20CosmosDB%20collection.%20A%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fcosmos-db%2Fhow-to-configure-private-endpoints%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ECosmosDB%20private%20endpoint%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eis%20created%2C%20and%20the%20function%20communicates%20with%20CosmosDB%20via%20the%20private%20endpoint.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECosmosDB%20supports%20different%20API%20(Sql%2C%20Cassandra%2C%20Mongo%2C%20Table%2C%20etc.)%20types%2C%20and%20a%20private%20endpoint%20is%20needed%20for%20each.%20Meaning%2C%20there%20is%20a%20private%20endpoint%20for%20the%20SQL%20protocol%2C%20and%20another%20private%20endpoint%20for%20the%20Mongo%20protocol%2C%20etc.%20This%20sample%20uses%20the%20Sql%20API%20type%2C%20and%20therefore%20it%20is%20only%20necessary%20to%20configure%20a%20private%20endpoint%20for%20the%20Sql%20API.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20mentioned%20previously%2C%20this%20sample%20uses%20an%20ARM%20template%20to%20provision%20the%20Azure%20resources.%20It%20is%20important%20to%20note%20the%20value%20for%20the%20%3CEM%3EgroupIds%26nbsp%3B%3C%2FEM%3Ein%20the%20ARM%20template%20below%20is%20case%20sensitive.%20In%20most%20cases%2C%20ARM%20templates%20are%20not%20case%20sensitive.%20In%20this%20case%2C%20since%20the%20CosmosDB%20SQL%20API%20is%20being%20used%2C%20the%20value%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CEM%3Emust%3C%2FEM%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ebe%20%E2%80%9CSql%E2%80%9D.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-json%22%3E%3CCODE%3E%7B%0A%20%20%20%20%22type%22%3A%20%22Microsoft.Network%2FprivateEndpoints%22%2C%0A%20%20%20%20%22name%22%3A%20%22%5Bvariables('privateEndpointCosmosDbName')%5D%22%2C%0A%20%20%20%20%22apiVersion%22%3A%20%222019-11-01%22%2C%0A%20%20%20%20%22location%22%3A%20%22%5Bparameters('location')%5D%22%2C%0A%20%20%20%20%22dependsOn%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%22%5BresourceId('Microsoft.DocumentDB%2FdatabaseAccounts'%2C%20variables('privateCosmosDbAccountName'))%5D%22%2C%0A%20%20%20%20%20%20%20%20%22%5BresourceId('Microsoft.Network%2FvirtualNetworks'%2C%20variables('vnetName'))%5D%22%0A%20%20%20%20%5D%2C%0A%20%20%20%20%22properties%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22subnet%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%22id%22%3A%20%22%5BresourceId('Microsoft.Network%2FvirtualNetworks%2Fsubnets'%2C%20variables('vnetName')%2C%20variables('privateEndpointSubnetName')%20)%5D%22%0A%20%20%20%20%20%20%20%20%7D%2C%0A%20%20%20%20%20%20%20%20%22privateLinkServiceConnections%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22name%22%3A%20%22MyCosmosDbPrivateLinkConnection%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22properties%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22privateLinkServiceId%22%3A%20%22%5BresourceId('Microsoft.DocumentDB%2FdatabaseAccounts'%2C%20variables('privateCosmosDbAccountName'))%5D%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22groupIds%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22Sql%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%5D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%5D%0A%20%20%20%20%7D%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22private-azure-dns-zones%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%20id%3D%22toc-hId-812598341%22%3EPrivate%20Azure%20DNS%20Zones%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20working%20with%20private%20endpoints%2C%20it%20is%20necessary%20to%20make%20changes%20your%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fprivate-link%2Fprivate-endpoint-overview%23dns-configuration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EDNS%20configuration%3C%2FA%3E.%20You%20can%20either%20use%20a%20host%20file%20on%20a%20VM%20within%20the%20virtual%20network%2C%20a%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fdns%2Fprivate-dns-privatednszone%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eprivate%20DNS%20zone%3C%2FA%3E%2C%20or%20your%20own%20DNS%20server%20hosted%20within%20the%20virtual%20network.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CBLOCKQUOTE%3E%0A%3CP%3EMore%20information%20on%20Private%20Endpoint%20DNS%20configuration%20can%20be%20found%20in%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fprivate-link%2Fprivate-endpoint-dns%23dns-configuration-scenarios%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eofficial%20documentation%3C%2FA%3E.%3C%2FP%3E%0A%3C%2FBLOCKQUOTE%3E%0A%3CP%3EAzure%20services%20have%20DNS%20configuration%20to%20know%20how%20to%20connect%20to%20other%20Azure%20services%20over%20a%20public%20endpoint.%20However%2C%20when%20using%20a%20private%20endpoint%2C%20the%20connection%20isn%E2%80%99t%20made%20over%20the%20public%20endpoint.%20It%E2%80%99s%20made%20using%20a%20private%20IP%20address%20allocated%20specifically%20for%20that%20Azure%20resource.%20Therefore%2C%20the%20default%20DNS%20configuration%20will%20need%20to%20be%20overridden.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOne%20of%20the%20nice%20things%20about%20working%20with%20private%20endpoints%20is%20that%20the%20connection%20string%20used%20by%20the%20calling%20service%20doesn%E2%80%99t%20need%20to%20change.%20In%20other%20words%2C%20you%20can%20use%20%3CEM%3Econtoso.blob.core.windows.net%3C%2FEM%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eto%20connect%20to%20either%20the%20public%20endpoint%20or%20the%20private%20endpoint%20(for%20blob%20storage%20in%20the%20Contoso%20storage%20account).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20is%20made%20possible%20by%20using%20private%20DNS%20zones.%20The%20private%20endpoint%20creates%20an%20alias%20in%20a%20subdomain%20prefixed%20with%20%E2%80%9Cprivatelink%E2%80%9D.%20For%20example%2C%20blobs%20in%20an%20Azure%20Storage%20account%20may%20have%20a%20public%20DNS%20name%20of%3CSPAN%3E%26nbsp%3B%3CEM%3Econtoso.blob.core.windows.net%3C%2FEM%3E%3C%2FSPAN%3E.%20A%20private%20DNS%20zone%20is%20created%20which%20corresponds%20to%26nbsp%3B%3CEM%3Econtoso.privatelink.blob.core.windows.net%3C%2FEM%3E.%20A%20DNS%20A%20record%20is%20created%20for%20each%20private%20IP%20address%20associated%20with%20the%20private%20endpoint.%20Clients%20within%20the%20virtual%20network%20resolve%20the%20connection%20to%20the%20storage%20account%20as%20follows%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTHEAD%3E%0A%3CTR%3E%0A%3CTH%20width%3D%22343.333px%22%3EName%3C%2FTH%3E%0A%3CTH%20width%3D%2265.3333px%22%3EType%3C%2FTH%3E%0A%3CTH%20width%3D%22343.333px%22%3EValue%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3C%2FTHEAD%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22343.333px%22%3Econtoso.blob.core.windows.net%3C%2FTD%3E%0A%3CTD%20width%3D%2265.3333px%22%3ECNAME%3C%2FTD%3E%0A%3CTD%20width%3D%22343.333px%22%3Econtoso.privatelink.blob.core.windows.net%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22343.333px%22%3Econtoso.privatelink.blob.core.windows.net%3C%2FTD%3E%0A%3CTD%20width%3D%2265.3333px%22%3EA%3C%2FTD%3E%0A%3CTD%20width%3D%22343.333px%22%3E10.100.1.6%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EClients%20external%20to%20the%20virtual%20network%20continue%20to%20resolve%20to%20the%20public%20IP%20address%20of%20the%20service.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%20id%3D%22toc-hId--865773403%22%3EThe%20Zones%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20sample%20uses%20private%20endpoints%20for%20Azure%20Storage%20and%20CosmosDB.%20As%20such%2C%20private%20DNS%20zones%20are%20needed%20for%20each%20Azure%20storage%20service%2C%20as%20well%20as%20the%20Sql%20API%20for%20CosmosDB.%20Meaning%2C%20five%20DNS%20zones%20are%20needed%20to%20support%20this%20sample%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3Eprivatelink.queue.core.windows.net%3C%2FLI%3E%0A%3CLI%3Eprivatelink.blob.core.windows.net%3C%2FLI%3E%0A%3CLI%3Eprivatelink.table.core.windows.net%3C%2FLI%3E%0A%3CLI%3Eprivatelink.file.core.windows.net%3C%2FLI%3E%0A%3CLI%3Eprivatelink.documents.azure.com%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%20data-unlink%3D%22true%22%3EWhen%20creating%20the%20zones%2C%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fprivate-link%2Fprivate-endpoint-dns%23azure-services-dns-zone-configuration%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Erecommended%20zone%20names%3C%2FA%3E%20where%20used.%26nbsp%3B%3C%2FP%3E%0A%3CP%20data-unlink%3D%22true%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20data-unlink%3D%22true%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%20id%3D%22toc-hId-1621739430%22%3ESetting%20it%20up%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20ARM%20template%20uses%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ftemplates%2Fmicrosoft.network%2Fprivateendpoints%2Fprivatednszonegroups%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EprivateDnsZoneGroups%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Esub-type%20to%20configure%20the%20DNS%20zone%2C%20obtaining%20the%20private%20IP%20address%20for%20the%20configured%20service%2C%20and%20setting%20up%20the%20corresponding%20DNS%20A%20record.%3C%2FP%3E%0A%3CP%3EBelow%20is%20a%20snippet%20from%20the%20ARM%20template%20which%20shows%20using%20the%26nbsp%3B%3CEM%3EMicrosoft.Network%2FprivateEndpoints%2FprivateDnsZoneGroups%3C%2FEM%3E%26nbsp%3Btype.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-json%22%3E%3CCODE%3E%7B%0A%20%20%20%20%22type%22%3A%20%22Microsoft.Network%2FprivateEndpoints%2FprivateDnsZoneGroups%22%2C%0A%20%20%20%20%22apiVersion%22%3A%20%222020-03-01%22%2C%0A%20%20%20%20%22location%22%3A%20%22%5Bparameters('location')%5D%22%2C%0A%20%20%20%20%22name%22%3A%20%22%5Bconcat(variables('privateEndpointCosmosDbName')%2C%20'%2Fdefault')%5D%22%2C%0A%20%20%20%20%22dependsOn%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%22%5BresourceId('Microsoft.Network%2FprivateDnsZones'%2C%20variables('privateCosmosDbDnsZoneName'))%5D%22%2C%0A%20%20%20%20%20%20%20%20%22%5BresourceId('Microsoft.Network%2FprivateEndpoints'%2C%20variables('privateEndpointCosmosDbName'))%5D%22%0A%20%20%20%20%5D%2C%0A%20%20%20%20%22properties%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22privateDnsZoneConfigs%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22name%22%3A%20%22config1%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22properties%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%22privateDnsZoneId%22%3A%20%22%5BresourceId('Microsoft.Network%2FprivateDnsZones'%2C%20variables('privateCosmosDbDnsZoneName'))%5D%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%5D%0A%20%20%20%20%7D%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22summary%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%20id%3D%22toc-hId--314797752%22%3ESummary%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20post%20outline%20the%20key%20components%20that%20are%20necessary%20to%20connect%20to%20private%20endpoints%20with%20Azure%20Functions.%20Private%20endpoints%20allow%20for%20interaction%20with%20designated%20Azure%20resources%20via%20private%20IP%20address%2C%20thus%20keeping%20network%20traffic%20between%20the%20function%20and%20the%20resource%20confined%20to%20the%20virtual%20network.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EConnecting%20to%20private%20endpoints%20with%20Azure%20Functions%20requires%20there%20to%20be%20a%20virtual%20network%20(with%20a%20few%20subnets)%2C%20an%20Azure%20Functions%20Premium%20plan%20with%20VNet%20Integration%20enabled%2C%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fprivate-link%2Fprivate-endpoint-overview%23private-link-resource%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20resources%20to%20connect%20to%20which%20support%20private%20endpoints%3C%2FA%3E%2C%20and%20modifications%20to%20DNS%20configuration.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1426615%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20article%20demonstrates%20one%20approach%20for%20Azure%20Functions%20to%20connect%20to%20Azure%20resources%20such%20as%20Azure%20Storage%20and%20CosmosDB%20using%20a%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fprivate-link%2Fprivate-endpoint-overview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eprivate%20endpoint%3C%2FA%3E.%26nbsp%3B%20Additionally%2C%20this%20article%20demonstrates%20how%20to%20configure%20the%20Azure%20Storage%20accounts%20required%20by%20Azure%20Functions%20so%20that%20they're%20accessible%20via%20private%20endpoints.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1426615%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Functions%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1627352%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1627352%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%2C%3C%2FP%3E%3CP%3Ereally%20interesting%20article%20%2C%20I%20previously%20deployed%20a%20function%20app%20with%20vnet%20integration%20enabled%20%2C%20trying%20to%20add%20the%20private%20endpoint%20on%20the%20subnet%20choose%20for%20the%20vnet%20integration%20using%20the%20portal%20but%20I%20get%20a%20message%20that%20says%20%3A%20%22your%20subnet%20is%20a%20delegated%20subnet%20%2C%20private%20endpoint%20cannot%20be%20created%22%20.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20I%20can%20handle%20with%20that%20%3F%20I%20mean%20%2C%20private%20endpoint%20should%20be%20created%20before%20to%20enable%20%26nbsp%3Bthe%20vnet%20integration%20%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1627364%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1627364%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F662909%22%20target%3D%22_blank%22%3E%40pioardi%3C%2FA%3E%26nbsp%3Byou'll%20need%20to%20add%20another%20subnet%20and%20enable%20the%20private%20endpoint%20there.%20The%20delegated%20one%20will%20only%20work%20for%20the%20VNET%20Integration.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHope%20it%20helps.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1627548%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1627548%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F399919%22%20target%3D%22_blank%22%3E%40cmendibl3%3C%2FA%3E%26nbsp%3B%20%2C%20thanks%20for%20your%20answer%20.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20the%20subnet%20with%20the%20private%20endpoint%20created%20must%20be%20another%20one%20%2C%20but%20in%20the%20same%20virtual%20network%20where%20the%20virtual%20network%20integration%20happen.%3C%2FP%3E%3CP%3EI%20tried%20and%20is%20working%20properly%20%2C%20thanks%20!!!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGreat%20article%20!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1659805%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1659805%22%20slang%3D%22en-US%22%3E%3CP%3EGreat%20article.%3C%2FP%3E%3CP%3EWhenever%20you%20use%20the%20WEBSITE_VNET_ROUTE_ALL%20setting%20in%20a%20function%20app%2C%20shouldn't%20the%20backing%20storage%20account%20for%20that%20function%20%3CEM%3Ealways%3C%2FEM%3E%20be%20part%20of%20the%20same%20VNet%20(with%20a%20private%20endpoint)%2C%20or%20else%20how%20could%20the%20function%20host%20otherwise%20ever%20reach%20the%20storage%20container%3F%26nbsp%3BThe%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-functions%2Ffunctions-networking-options%23restrict-your-storage-account-to-a-virtual-network%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMS%20documentation%3C%2FA%3E%20is%20a%20bit%20confusing%20on%20that%2C%20claiming%20the%20opposite.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1660244%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1660244%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F790971%22%20target%3D%22_blank%22%3E%40Crossbow%3C%2FA%3E%26nbsp%3Bthe%20communication%20with%20the%20storage%20account%20depends%20also%20on%20the%20storage%20account%20firewall%20.%3C%2FP%3E%3CP%3EIf%20you%20are%20using%20vnet%20integration%20and%20you%20choose%20a%20subnet%20X%20for%20the%20vnet%20integration%20%2C%20you%20should%26nbsp%3B%20configure%20the%20storage%20account%20firewall%20to%20allow%20transit%20from%20the%20subnet%20X%20.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStorage%20accounts%20%2C%20technically%20%2C%20are%20not%20part%20of%20any%20vnet%20or%20subnet%20%2C%20you%20just%20configure%20which%20network%20can%20access%20to%20it%20and%20how%20(%20service%20endpoint%20vs%20private%20endpoint%20)%20.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1661015%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20to%20private%20endpoints%20with%20Azure%20Functions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1661015%22%20slang%3D%22en-US%22%3E%3CP%3EUnlucky%20phrasing%20yes.%3C%2FP%3E%3CP%3EI'm%20seeing%20weird%20behavior%20with%20my%20function%20app%2C%20which%20is%20linked%20to%20a%20VNet%2C%20and%20the%20WEBSITE_VNET_ROUTE_ALL%20flag%20is%20set.%3C%2FP%3E%3CP%3EWhen%20the%20app%20is%20started%2C%20the%20whole%20function-host%20errors%20out%20since%20it%20can%20not%20access%20its%20backing%20storage%20account%20(%22connection%20timed%20out%22)%20even%20though%20that%20account%20is%20open%20to%20all%20networks%20(ie.%20the%20firewall%2FVNet%20integration%20is%20disabled).%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

As enterprises continue to adopt serverless (and Platform-as-a-Service, or PaaS) solutions, they often need a way to integrate with existing resources on a virtual network. These existing resources could be databases, file storage, message queues or event streams, or REST APIs. In doing so, those interactions need to take place within the virtual network. Until relatively recently, combining serverless/PaaS offerings with traditional network access restrictions was complex, if not nearly impossible.

 

With the introduction of Azure Virtual Network service endpoints and private endpoints, it’s becoming easier for enterprises to realize the benefits of serverless, while also complying with necessary virtual network access controls.

 

This post will detail how to configure an Azure Function to work with Azure resources using private endpoints. Private endpoints ensure that the designated resources are accessible only via the specified virtual network. The Azure Function app will communicate with designated resources using a resource-specific private IP address (e.g. 10.100.0/24 address space). This provides an additional level of network-based security and control.

 

The sample shown in this post discusses the following key concepts necessary to use private endpoints with Azure Functions:

  • Azure Function with blob trigger and CosmosDB output binding
  • Azure Function Premium plan with Virtual Network Integration enabled
  • Virtual network
  • Configuring private endpoints for Azure resources
    • Azure Storage private endpoints
    • Azure Cosmos DB private endpoint
  • Using private Azure DNS zones

Additionally, the sample uses an Azure VM and Azure Bastion in order to access Azure resources within the virtual network. The VM and Azure Bastion setup is not discussed in this post. If you want to learn more about using Azure Bastion, please refer to https://docs.microsoft.com/azure/bastion/bastion-overview

 

Please view the full sample and related artifacts on the Microsoft Code Samples site.

 

Architecture Overview

 

The following diagram shows the high-level architecture of the solution to be created:

high-level-architecture.jpg

Deployment

In order to get started with this sample, you’ll need an Azure subscription. If you don’t have one, you can get a free Azure account at https://azure.microsoft.com/free/.

 

Prerequisites

 

Deploy the Resource Manager template

An Azure Resource Manager (ARM) template is available to provision the necessary Azure resources. The template will also create the application settings needed by the Azure Function sample code. The Azure CLI can be used to deploy the template:

resourceGroupName="functions-private-endpoints"
location="eastus"
now=`date +%Y%m%d-%H%M%S`
deploymentName="azuredeploy-$now"

echo "Creating resource group '$resourceGroupName' in region '$location' . . ."
az group create --name $resourceGroupName --location $location

echo "Deploying main template . . ."
az deployment group create -g $resourceGroupName --template-file azuredeploy.json --parameters azuredeploy.parameters.json --name $deploymentName

 

Deploy the code

The function can be published manually by using the Azure Function Core Tools:

 

 

 

 

 

func azure functionapp publish <function-app-name>

 

 

 

 

 

Virtual Network

One of the first components to set up is the virtual network. Nearly all other Azure services in this sample are either provisioned into, or integrated with, the virtual network. After all, this sample is about using private endpoints, and private endpoints go along with a virtual network (can’t have one without the other).

 

The sample uses four subnets:

  1. Subnet for Azure Function virtual network integration. This subnet is delegated to the function.
  2. Subnet for private endpoints. Private IP addresses are allocated from this subnet.
  3. Subnet for the virtual machine. The template creates a VM which is placed within this subnet.
  4. Subnet for the Azure Bastion host.

 

Virtual Network (VNet) Integration

 

In order for the function to access resources within the virtual network, VNet Integration is needed. The matrix of Azure Functions networking features shows that there are currently three options for VNet Integration:

  1. Azure Functions Premium plan
  2. Azure App Service Plan
  3. Azure App Service Environment

An Azure Function Premium plan is used in this sample. By using an Azure Function Premium plan with VNet Integration enabled, the function is able to access Azure Storage and CosmosDB via the configured private endpoints.

 

Please refer to the official documentation for more information on using Azure Functions with virtual network integration.

 

Azure Function

 

The function used in this sample is based on a simplified concept of processing data from CSV files.  At a high level, the function logic is as follows:

 

  1. Trigger on a new CSV-formatted file being available in a specific Azure Storage blob container
  2. Convert the CSV file to JSON
  3. Save the JSON document to CosmosDB via an output binding

 

The function is invoked via an Azure Storage blob trigger. The storage account used by the blob trigger is configured with a private endpoint. The function assumes the file is in a CSV format, and then converts the CSV content to JSON. The resulting JSON document is saved to an Azure CosmosDB collection via an output binding.

 

 

 

 

 

[FunctionName("WidgetOrdersFunction")]
public static async Task ProcessOrderDataFiles(
    [BlobTrigger("%ContainerName%/{blobName}", Connection = "WidgetsAzureStorageConnection")] Stream myBlobStream,
    string blobName,
    [CosmosDB(
        databaseName: "%CosmosDbName%",
        collectionName: "%CosmosDbCollectionName%",
        ConnectionStringSetting = "CosmosDBConnection")] IAsyncCollector<string> items,
    ILogger logger)
{
    logger.LogInformation($"C# Blob trigger function processed blob of name '{blobName}' with size of {myBlobStream.Length} bytes");

    var jsonObject = await ConvertCsvToJsonAsync(myBlobStream);

    foreach (var item in jsonObject)
    {
        await items.AddAsync(JsonConvert.SerializeObject(item));
    }
}

 

 

 

 

 

Azure Function Configuration

There are a few important details about the configuration of the function.

 

Run from Package

 

The function is configured to run from a deployment package. As such, the package is persisted in an Azure File share referenced by the WEBSITE_CONTENTAZUREFILECONNECTIONSTRING application setting. Please review the section below on Azure Storage Private Endpoints for why this is important in this scenario.

 

Virtual Network Triggers

Virtual network trigger support must be enabled in order for the function to trigger against resources using a private endpoint. Virtual network trigger support can be enabled via the Azure portal, the Azure CLI, or via an ARM template (as done in this sample).

 

 

 

 

 

{
    "type": "config",
    "name": "web",
    "apiVersion": "2019-08-01",
    "dependsOn": [
        "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]",
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
    ],
    "properties": {
        "functionsRuntimeScaleMonitoringEnabled": true
    }
}

 

 

 

 

 

View the full ARM template here.

 

Azure DNS Private Zones

 

When using VNet Integration, the function app uses the same DNS server that is configured for the virtual network. To work with a private endpoint, the default configuration needs to be overridden. In order to make calls to a resource using a private endpoint, it is necessary to integrate with Azure DNS Private Zones.

 

Private endpoints automatically create Azure DNS Private Zones. The Azure DNS Private Zone contains the details on how to route requests to the private IP address for the designated Azure service. Therefore, it is necessary to configure the app to use a specific Azure DNS server, and also route all network traffic into the virtual network. This is accomplished by setting the following application settings:

 

Name Value
WEBSITE_DNS_SERVER 168.63.129.16
WEBSITE_VNET_ROUTE_ALL 1

 

Azure Storage Private Endpoints

 

Azure Functions requires an Azure Storage account for persisting runtime metadata and metadata related to various triggers. The official Microsoft documentation indicates that it is currently not possible to use Azure Functions with a storage account which uses virtual network restrictions. While that’s mostly true, there is a workaround.

 

The workaround being that it is possible to put virtual network restrictions on the Azure storage account referenced via the AzureWebJobsStorage application setting. However, if that is done, then a separate storage account - one without network restrictions - is needed.

 

The other (without network restrictions) storage account needs to be referenced via the WEBSITE_CONTENTAZUREFILECONNECTIONSTRING application setting. It is this storage account that will contain an Azure File share used to persist the function’s application code.

 

Furthermore, for this sample, a third storage account is used. This third storage account is used by the sample application code - it’s where the CSV file will be placed. The Function blob trigger will pick up this file and the function will do work against it. This storage account will also use a private endpoint.

 

The sample will use three Azure storage related application settings:

 

Name Description Uses a Private Endpoint?
WidgetsAzureStorageConnection The connection string for an Azure Storage account used by the function’s blob trigger. Yes
AzureWebJobsStorage The connection string for an Azure Storage account required by Azure Functions. Yes
WEBSITE_CONTENTAZUREFILECONNECTIONSTRING The connection string references an Azure Storage account which contains an Azure File share used to store the application content/code. No

 

When using private endpoints for Azure Storage, it is necessary to create a private endpoint for each Azure Storage service (table, blob, queue, or file). Therefore, this samples sets up 5 private endpoints related to Azure Storage.

 

  • Four private endpoints related to each of the services referenced by the AzureWebJobsStorage application setting.
  • One private endpoint for blob storage referenced by the WidgetsAzureStorageConnection application setting. This is the only private endpoint related to the WidgetsAzureStorageConnection application setting.

 

Azure Cosmos DB Private Endpoints

 

As mentioned previously, a CosmosDB output binding is used to save data to a CosmosDB collection. A CosmosDB private endpoint is created, and the function communicates with CosmosDB via the private endpoint.

 

CosmosDB supports different API (Sql, Cassandra, Mongo, Table, etc.) types, and a private endpoint is needed for each. Meaning, there is a private endpoint for the SQL protocol, and another private endpoint for the Mongo protocol, etc. This sample uses the Sql API type, and therefore it is only necessary to configure a private endpoint for the Sql API.

 

As mentioned previously, this sample uses an ARM template to provision the Azure resources. It is important to note the value for the groupIds in the ARM template below is case sensitive. In most cases, ARM templates are not case sensitive. In this case, since the CosmosDB SQL API is being used, the value must be “Sql”. 

 

 

 

 

 

{
    "type": "Microsoft.Network/privateEndpoints",
    "name": "[variables('privateEndpointCosmosDbName')]",
    "apiVersion": "2019-11-01",
    "location": "[parameters('location')]",
    "dependsOn": [
        "[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('privateCosmosDbAccountName'))]",
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
    ],
    "properties": {
        "subnet": {
            "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('privateEndpointSubnetName') )]"
        },
        "privateLinkServiceConnections": [
            {
                "name": "MyCosmosDbPrivateLinkConnection",
                "properties": {
                    "privateLinkServiceId": "[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('privateCosmosDbAccountName'))]",
                    "groupIds": [
                        "Sql"
                    ]
                }
            }
        ]
    }
}

 

 

 

 

 

Private Azure DNS Zones

 

When working with private endpoints, it is necessary to make changes your DNS configuration. You can either use a host file on a VM within the virtual network, a private DNS zone, or your own DNS server hosted within the virtual network. 

 

More information on Private Endpoint DNS configuration can be found in the official documentation.

Azure services have DNS configuration to know how to connect to other Azure services over a public endpoint. However, when using a private endpoint, the connection isn’t made over the public endpoint. It’s made using a private IP address allocated specifically for that Azure resource. Therefore, the default DNS configuration will need to be overridden.

 

One of the nice things about working with private endpoints is that the connection string used by the calling service doesn’t need to change. In other words, you can use contoso.blob.core.windows.net to connect to either the public endpoint or the private endpoint (for blob storage in the Contoso storage account).

 

This is made possible by using private DNS zones. The private endpoint creates an alias in a subdomain prefixed with “privatelink”. For example, blobs in an Azure Storage account may have a public DNS name of contoso.blob.core.windows.net. A private DNS zone is created which corresponds to contoso.privatelink.blob.core.windows.net. A DNS A record is created for each private IP address associated with the private endpoint. Clients within the virtual network resolve the connection to the storage account as follows:

 

Name Type Value
contoso.blob.core.windows.net CNAME contoso.privatelink.blob.core.windows.net
contoso.privatelink.blob.core.windows.net A 10.100.1.6

 

Clients external to the virtual network continue to resolve to the public IP address of the service.

 

The Zones

 

This sample uses private endpoints for Azure Storage and CosmosDB. As such, private DNS zones are needed for each Azure storage service, as well as the Sql API for CosmosDB. Meaning, five DNS zones are needed to support this sample:

  1. privatelink.queue.core.windows.net
  2. privatelink.blob.core.windows.net
  3. privatelink.table.core.windows.net
  4. privatelink.file.core.windows.net
  5. privatelink.documents.azure.com

When creating the zones, the recommended zone names where used. 

 

Setting it up

 

The ARM template uses the privateDnsZoneGroups sub-type to configure the DNS zone, obtaining the private IP address for the configured service, and setting up the corresponding DNS A record.

Below is a snippet from the ARM template which shows using the Microsoft.Network/privateEndpoints/privateDnsZoneGroups type.

 

 

 

 

 

{
    "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
    "apiVersion": "2020-03-01",
    "location": "[parameters('location')]",
    "name": "[concat(variables('privateEndpointCosmosDbName'), '/default')]",
    "dependsOn": [
        "[resourceId('Microsoft.Network/privateDnsZones', variables('privateCosmosDbDnsZoneName'))]",
        "[resourceId('Microsoft.Network/privateEndpoints', variables('privateEndpointCosmosDbName'))]"
    ],
    "properties": {
        "privateDnsZoneConfigs": [
            {
                "name": "config1",
                "properties": {
                    "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', variables('privateCosmosDbDnsZoneName'))]"
                }
            }
        ]
    }
}

 

 

 

 

 

Summary

 

This post outline the key components that are necessary to connect to private endpoints with Azure Functions. Private endpoints allow for interaction with designated Azure resources via private IP address, thus keeping network traffic between the function and the resource confined to the virtual network.

 

Connecting to private endpoints with Azure Functions requires there to be a virtual network (with a few subnets), an Azure Functions Premium plan with VNet Integration enabled, Azure resources to connect to which support private endpoints, and modifications to DNS configuration. 

 

8 Comments

Hello @Michael Collier ,

 

Thanks for this interesting post. Is there any change (compared to what you wrote) regarding the private DNS zones? When enabling private link from the portal, a private DNS zone is indeed created but it doesn't create any ALIAS record. Trying to add one manually fails as the zone tells it already exists (but is not visible in any case) and indeed, resolving the public DNS from within the VNET works although no ALIAS record is visible. Any clue on that?

 

[edit]

Ok realized that the CNAME is automatically created and out of scope for the Cloud consumer.

[/edit]

Best Regards

 

Hi @Michael Collier,

 

Nice post! I managed to make the Azure Function work with Private Endpoints for the backing Storage Accounts with the following steps:

 

  • Created service endpoints for each service of the backing SA (blob, table, queue and files)
  • During Function deployment network restrictions are disabled for the backing SA
  • After successful deployment network restrictions are enabled.

 

I updated the post, I wrote back in May, with some notes and code here, where I'm using the same storage account for the backing services and also to hold 2 containers used by the Function to simply copy form one to another.

 

Best Regards

New Contributor

Hi ,

really interesting article , I previously deployed a function app with vnet integration enabled , trying to add the private endpoint on the subnet choose for the vnet integration using the portal but I get a message that says : "your subnet is a delegated subnet , private endpoint cannot be created" .

 

How I can handle with that ? I mean , private endpoint should be created before to enable  the vnet integration ? 

Hi @pioardi you'll need to add another subnet and enable the private endpoint there. The delegated one will only work for the VNET Integration.

 

Hope it helps.

New Contributor

Hi @cmendibl3  , thanks for your answer .

 

So the subnet with the private endpoint created must be another one , but in the same virtual network where the virtual network integration happen.

I tried and is working properly , thanks !!!

 

Great article !

Occasional Visitor

Great article.

Whenever you use the WEBSITE_VNET_ROUTE_ALL setting in a function app, shouldn't the backing storage account for that function always be part of the same VNet (with a private endpoint), or else how could the function host otherwise ever reach the storage container? The MS documentation is a bit confusing on that, claiming the opposite.

New Contributor

@Crossbow the communication with the storage account depends also on the storage account firewall .

If you are using vnet integration and you choose a subnet X for the vnet integration , you should  configure the storage account firewall to allow transit from the subnet X .

 

Storage accounts , technically , are not part of any vnet or subnet , you just configure which network can access to it and how ( service endpoint vs private endpoint ) .

Occasional Visitor

Unlucky phrasing yes.

I'm seeing weird behavior with my function app, which is linked to a VNet, and the WEBSITE_VNET_ROUTE_ALL flag is set.

When the app is started, the whole function-host errors out since it can not access its backing storage account ("connection timed out") even though that account is open to all networks (ie. the firewall/VNet integration is disabled).