vNet Integration Service Endpoints

[JacksWastedLife]

Hi, 

I'm trying to understand in vNet Integrated AppServices can access other service endpoints. I have a number of WebApps which are vNet Integrated and I want to deploy a service bus and cosmos DB - Can I configure service endpoints of the AppService subnets to call the Service Bus and Cosmos Service endpoints or will the apps still need to call these endpoints over the public internet. 

So basically can vNet Integrated apps call resources using Service Endpoints? 

Thanks

[#2]

@JacksWastedLife 

By configuring service endpoint you enable the private resources (VM) hosted on your subnet to communicate with the PaaS service (App Service) through Azue backbone network instead of open internet. However, you are still using the public endpoint of your PaaS resource.

You can turn off public access by configuring 'Firewalls and virtual networks' option properly. In this option you have to allow 'trusted Microsoft Services' under 'Exceptions' section in order to enable communication between your PaaS resource and other PaaS services. In my view this PaaS to PaaS communication takes place via Azure backbone (Microsoft network routing endpoint) by default. So this will be the case always even if you do not have service endpoints of all the services enabled on your subnet.

If you want to go complete private, you have to configure private link for your PaaS resources. This will allow you to assign private IP from your subnet to the PaaS resources. Still you have to configure 'Firewalls and virtual networks' to suit your requirement. 

Hope this helps!

Thanks,

Rohan

[#3]

@rohanislam Thanks. 

I kinda guess that would be the case with PaaS to PaaS. So on that basis, I don't need to worry about traffic between the WebApp and ServiceBus/Cosmos passing over public internet? 

So we only need to be a concern with resources in the vnet, such as VMs that I would need to enable service endpoints. 

[#4]

@JacksWastedLife Yes, that's correct.

Please keep in mind if you want to allow access from on-prem, the traffic is either routed via internet or Expresroute MS peering session depending on your infrastructure setup. So it is very critical to configure Firewall and vNet option properly.

Thanks,

Rohan