App Service Networking
What it is
App Service is a platform service. In the multitenant service, its inbound and outbound networking use different features. The most important beginner rule is: a feature that controls requests to the app is not normally the feature that controls calls from the app.
- Inbound (who can reach the app) — Access/IP restrictions and Private Endpoints.
- Outbound (where the app can reach from its own VNet) — VNet integration.
Why it exists
By default, a multitenant App Service app is reachable from the internet and can reach internet-hosted endpoints. Networking features let a team restrict inbound callers, give inbound access a private IP, or let the app make outbound calls to private network resources.
Inbound: who can reach the app
- Access restrictions: ordered allow/deny rules for inbound requests, using sources such as IP ranges or service tags. They filter traffic on App Service front ends before it reaches the worker.
- Private Endpoint: a private network interface in your VNet for inbound flows to the app. It exposes the app on a private IP; private DNS and the network path determine whether callers can resolve and reach it. It does not configure the app’s outbound path.
- Service endpoints: can restrict inbound App Service access from selected VNet subnets in supported designs. They are distinct from Private Endpoints.
Outbound: which network the app runs against
- VNet integration: lets the app make outbound requests into a VNet. It can reach resources in the same-region VNet, peered networks, and appropriate VPN or ExpressRoute paths.
- Regional VNet integration: the usual choice for multitenant App Service. It does not need a gateway and uses an integration subnet.
- Gateway-required VNet integration: an older, Windows-only option using a point-to-site VPN gateway. Microsoft recommends regional VNet integration where it fits.
- Routes and NSGs: the integration subnet can use route tables and NSGs to shape outbound flows, but the full result depends on routing configuration and App Service settings.
Northwind example
Northwind makes its public ordering site reachable through its intended web edge, while VNet integration lets the app call a private database endpoint. A Private Endpoint gives internal callers a private inbound address for a staff-only companion app. Maya does not expect VNet integration to hide the public site, or the Private Endpoint to route the app’s outbound database calls; she uses the appropriate feature for each direction.
Exam facts
- VNet integration = outbound connectivity. It does not create a private inbound address.
- A Private Endpoint = inbound private connectivity. It does not configure outbound connectivity.
- Access restrictions filter callers but do not replace application authentication and authorization.
Related
app-service · vnet · subnet · nsg · private-dns · route-table