App Service Networking
What it is
App Service is a PaaS fleet hosted on shared platform IPs, but you can control how a web app receives inbound traffic and how its outbound traffic is routed by integrating it with your virtual network. The features fall into two directions:
- Inbound (who can reach the app) — Access/IP restrictions and Private Endpoints.
- Outbound (where the app can reach from its own VNet) — VNet integration.
Why it exists
By default an app is public on *.azurewebsites.net and its outbound traffic uses shared platform IPs. To lock an app behind your network (or give it a private, internal address) and to prevent unauthorized traffic, App Service lets you plug the app into your VNet — so it can reach resources that are themselves private (databases with service endpoints, private VMs, on-prem-linked subnets).
Inbound: who can reach the app
- Access restrictions / IP restrictions — an allow/deny list of inbound sources by IP address or CIDR range, service tag, or other match. Blocks traffic by IP/range before it reaches the app.
- Private Endpoints (App Service) — private link — attach a private endpoint inside your VNet so the app gets a private IP in your subnet; inbound traffic arrives over the private network and is only reachable from within the VNet (great for locking down). Requires your Private DNS zone to resolve the app’s internal name.
Outbound: which network the app runs against
- VNet integration — lets the app send outbound traffic through a subnet you chose (the deploy-subnet), so it can reach private resources:
- Regional VNet integration — modern default; uses the subnet’s named gateway (does not need a gateway), supports the whole address space of the VNet, and uses the app as part of the subnet for routing.
- Gateway-required (legacy / classic) VNet integration — older model that required a point-to-site VPN gateway in the VNet and allowed more limited routing (a
/28subnet range per the older model).
- Route-table / NSG control — the integration subnet is subject to your route tables and NSGs just like any subnet, so you can egress through a network virtual appliance.
Exam facts
- VNet integration = outbound traffic routing through your VNet; it does not expose a private inbound address. Inbound privacy needs a private endpoint or access restrictions.
- Two integration models: regional (no gateway, cheaper, default) vs gateway-required (older, needs a point-to-site VPN gateway).
- For inbound restrictions: IP/Access restrictions (source filtering) and private endpoints (private subnet address) are separate tools — pick based on whether you want IP filtering or full isolation.
Related
app-service · vnet · subnet · nsg · private-dns · route-table