Clarify that publicNetworkAccess is not applicable for APIM Premium V2 VNet-injected instances - #128611
Clarify that publicNetworkAccess is not applicable for APIM Premium V2 VNet-injected instances#128611Shikha Sinha (shksin) wants to merge 1 commit into
Conversation
Clarified note on public network access for VNet injection.
|
Shikha Sinha (@shksin) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Shikha Sinha (@shksin) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Learn Build status updates of commit 869d82c: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Clarifies that publicNetworkAccess does not affect API Management Premium v2 instances using Internal VNet injection, and that inbound exposure is controlled via VNet/NSG configuration.
Changes:
- Add a NOTE explaining
publicNetworkAccessis not applicable for Internal-mode VNet injection - Clarify that NSGs and VNet routing define the network perimeter for VNet-injected instances
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| :::image type="content" source="./media/inject-vnet-v2/vnet-injection.png" alt-text="Diagram of injecting an API Management instance in a virtual network to isolate inbound and outbound traffic." ::: | ||
|
|
||
| > [!NOTE] | ||
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. |
| :::image type="content" source="./media/inject-vnet-v2/vnet-injection.png" alt-text="Diagram of injecting an API Management instance in a virtual network to isolate inbound and outbound traffic." ::: | ||
|
|
||
| > [!NOTE] | ||
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. |
| :::image type="content" source="./media/inject-vnet-v2/vnet-injection.png" alt-text="Diagram of injecting an API Management instance in a virtual network to isolate inbound and outbound traffic." ::: | ||
|
|
||
| > [!NOTE] | ||
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. |
Pat Altimore (PatAltimore)
left a comment
Pat Altimore (PatAltimore)
left a comment
There was a problem hiding this comment.
Hi Shikha Sinha (@shksin), Thanks for the edit. I made some suggestions based on the Copilot feedback. Verified your change with the product team. Thanks, Pat
| :::image type="content" source="./media/inject-vnet-v2/vnet-injection.png" alt-text="Diagram of injecting an API Management instance in a virtual network to isolate inbound and outbound traffic." ::: | ||
|
|
||
| > [!NOTE] | ||
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. |
There was a problem hiding this comment.
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. | |
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled using NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behavior. |
|
Shikha Sinha (@shksin) Can you respond to the requested changes or let us know if you would like us to commit them? Pat Altimore (@PatAltimore) - When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
|
Can you commit the suggested changes? Once committed, I can sign off on the PR. Thanks, |
Users deploying API Management Premium v2 with Internal VNet injection attempt to set
publicNetworkAccess=Disabledexpecting to lock down public access, and are confused when it has no effect on traffic behaviour (and is rejected by ARM atcreation time). The docs do not currently explain that this property is only relevant for instances using inbound private endpoints.
With Internal VNet injection, the gateway endpoint is assigned a private IP address only and has no public IP. The network perimeter is controlled entirely through NSG rules and VNet routing. Setting
publicNetworkAccessto eitherEnabledorDisabledon a VNet-injected instance has no effect on traffic behaviour.