content_sources: - type: mslearn-adapted url: https://learn.microsoft.com/azure/azure-functions/functions-networking-options - type: mslearn-adapted url: https://learn.microsoft.com/azure/app-service/networking/private-endpoint - type: mslearn-adapted url: https://learn.microsoft.com/azure/private-link/private-endpoint-overview diagrams: - id: private-ingress-architecture type: flowchart source: self-generated justification: "Private endpoint ingress pattern from MSLearn networking documentation" based_on: - https://learn.microsoft.com/azure/app-service/networking/private-endpoint content_validation: status: verified last_reviewed: 2026-04-12 reviewer: agent core_claims: - claim: "Azure Functions private endpoints are supported on Flex Consumption, Premium, and Dedicated plans, but not classic Consumption" source: https://learn.microsoft.com/azure/azure-functions/functions-networking-options verified: true - claim: "App Service private endpoints use the sites group for the main app endpoint" source: https://learn.microsoft.com/azure/app-service/networking/private-endpoint verified: true - claim: "Private endpoints provide private IP-based access to the app through Azure Private Link" source: https://learn.microsoft.com/azure/private-link/private-endpoint-overview verified: true - claim: "Disabling public network access prevents public ingress to the function app" source: https://learn.microsoft.com/azure/app-service/networking/private-endpoint verified: true

Scenario 3: Private Ingress (Site Private Endpoint)¶

Full network isolation with private inbound access via site private endpoint and private outbound through VNet integration.

When to Use¶

• Zero-trust architectures requiring no public exposure
• Compliance requirements (PCI-DSS, HIPAA, FedRAMP)
• Internal-only APIs accessible only from corporate network
• Backend services in hub-spoke or landing zone architectures

Architecture¶

flowchart TD
    subgraph CORP["Corporate Network / VPN"]
        CLIENT[Internal Client]
    end

    CLIENT -->|Private IP| PE_APP[Site Private Endpoint]

    subgraph VNET["VNet"]
        subgraph PE_SUB["Private Endpoint Subnet"]
            PE_APP
            PE_BLOB[PE: blob]
            PE_QUEUE[PE: queue]
            PE_TABLE[PE: table]
            PE_FILE[PE: file]
        end
        subgraph INT_SUB["Integration Subnet"]
            FA[Function App]
        end
    end

    PE_APP --> FA
    FA --> PE_BLOB
    PE_BLOB --> ST[Storage Account]
    PE_QUEUE --> ST
    PE_TABLE --> ST
    PE_FILE --> ST

    INET[Internet] -.->|Blocked| FA

    style FA fill:#0078d4,color:#fff
    style VNET fill:#E8F5E9,stroke:#4CAF50
    style ST fill:#FFF3E0
    style INET fill:#FFCDD2,stroke:#F44336

Supported Plans¶

[^1]: Basic (B1) supports VNet integration and private endpoints per Azure documentation, but is not tested or recommended for private networking scenarios in this guide. Use Standard (S1+) for production.

Prerequisites¶

Complete Scenario 2: Private Egress first. This scenario adds a site private endpoint on top of VNet integration.

Required from Scenario 2: - [ ] Function App with VNet integration enabled - [ ] Storage private endpoints configured - [ ] Private DNS zones linked to VNet

Additional requirements: - [ ] Private DNS zone for privatelink.azurewebsites.net - [ ] Network access from client (VPN, ExpressRoute, or same VNet)

Step-by-Step Configuration¶

Step 1: Get Function App Resource ID¶

export APP_ID=$(az functionapp show \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --query "id" \
  --output tsv)

Step 2: Create Site Private Endpoint¶

az network private-endpoint create \
  --name "pe-$APP_NAME" \
  --resource-group "$RG" \
  --location "$LOCATION" \
  --vnet-name "$VNET_NAME" \
  --subnet "snet-private-endpoints" \
  --private-connection-resource-id "$APP_ID" \
  --group-ids "sites" \
  --connection-name "conn-$APP_NAME"

Step 3: Create Private DNS Zone for Web Apps¶

az network private-dns zone create \
  --resource-group "$RG" \
  --name "privatelink.azurewebsites.net"

az network private-dns link vnet create \
  --resource-group "$RG" \
  --zone-name "privatelink.azurewebsites.net" \
  --name "link-webapp" \
  --virtual-network "$VNET_NAME" \
  --registration-enabled false

Step 4: Link Private Endpoint to DNS Zone¶

az network private-endpoint dns-zone-group create \
  --resource-group "$RG" \
  --endpoint-name "pe-$APP_NAME" \
  --name "webapp-dns-zone-group" \
  --private-dns-zone "privatelink.azurewebsites.net" \
  --zone-name "webapp"

Step 5: Disable Public Network Access (Recommended)¶

az functionapp update \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --set publicNetworkAccess=Disabled

Step 6: SCM Access for Deployment¶

For deployment from within the VNet:

# From a VM or agent in the VNet
func azure functionapp publish "$APP_NAME"

Verification¶

Check Private Endpoint Status¶

az network private-endpoint show \
  --name "pe-$APP_NAME" \
  --resource-group "$RG" \
  --query "privateLinkServiceConnections[0].privateLinkServiceConnectionState.status" \
  --output tsv

Expected output: Approved

Check Private DNS Records¶

az network private-dns record-set a list \
  --resource-group "$RG" \
  --zone-name "privatelink.azurewebsites.net" \
  --output table

Expected output includes records similar to $APP_NAME and $APP_NAME.scm.

Testing from VNet (VM/Bastion Required)¶

Option A: Deploy Jump Box VM with Bastion¶

# Create Bastion subnet (required: /26 or larger)
az network vnet subnet create \
  --resource-group "$RG" \
  --vnet-name "$VNET_NAME" \
  --name "AzureBastionSubnet" \
  --address-prefixes "10.0.3.0/26"

# Create management subnet for the jump box VM
az network vnet subnet create \
  --resource-group "$RG" \
  --vnet-name "$VNET_NAME" \
  --name "snet-management" \
  --address-prefixes "10.0.4.0/24"

# Create public IP for Bastion
az network public-ip create \
  --resource-group "$RG" \
  --name "pip-bastion-$APP_NAME" \
  --sku "Standard" \
  --location "$LOCATION"

# Create Bastion host (takes 5-10 minutes)
az network bastion create \
  --resource-group "$RG" \
  --name "bastion-$APP_NAME" \
  --vnet-name "$VNET_NAME" \
  --public-ip-address "pip-bastion-$APP_NAME" \
  --location "$LOCATION" \
  --sku "Basic"

# Create jump box VM (no public IP - accessed via Bastion)
az vm create \
  --resource-group "$RG" \
  --name "vm-jumpbox" \
  --image "Ubuntu2404" \
  --size "Standard_B1s" \
  --vnet-name "$VNET_NAME" \
  --subnet "snet-management" \
  --admin-username "azureuser" \
  --generate-ssh-keys \
  --public-ip-address ""

Connect to VM via Bastion¶

# Connect via Azure Portal: VM > Connect > Bastion
# Or use Azure CLI:
az network bastion ssh \
  --resource-group "$RG" \
  --name "bastion-$APP_NAME" \
  --target-resource-id $(az vm show --resource-group "$RG" --name "vm-jumpbox" --query "id" --output tsv) \
  --auth-type "ssh-key" \
  --username "azureuser" \
  --ssh-key ~/.ssh/id_rsa

Test from Jump Box¶

Once connected to the VM:

# Test DNS resolution - should return private IP (10.x.x.x)
nslookup $APP_NAME.azurewebsites.net

Expected output:

Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
func-demo.azurewebsites.net  canonical name = func-demo.privatelink.azurewebsites.net.
Name:   func-demo.privatelink.azurewebsites.net
Address: 10.0.2.5

# Test function endpoint
curl --request GET "https://$APP_NAME.azurewebsites.net/api/health"

Expected output:

{"status":"healthy","timestamp":"2026-04-11T10:30:00Z","version":"1.0.0"}

Option B: Minimal Test VM (No Bastion)¶

For quick testing, create a VM with public IP and SSH directly:

az vm create \
  --resource-group "$RG" \
  --name "vm-test" \
  --image "Ubuntu2404" \
  --size "Standard_B1s" \
  --vnet-name "$VNET_NAME" \
  --subnet "snet-management" \
  --admin-username "azureuser" \
  --generate-ssh-keys

# SSH to VM (use the public IP from output)
ssh azureuser@<public-ip>

# Test from inside VM
nslookup $APP_NAME.azurewebsites.net
curl --request GET "https://$APP_NAME.azurewebsites.net/api/health"

az vm delete --resource-group "$RG" --name "vm-test" --yes
az vm delete --resource-group "$RG" --name "vm-jumpbox" --yes
az network bastion delete --resource-group "$RG" --name "bastion-$APP_NAME"
az network public-ip delete --resource-group "$RG" --name "pip-bastion-$APP_NAME"

CI/CD Considerations¶

With public access disabled, deployment requires VNet connectivity:

Option A: Self-Hosted Agent in VNet¶

Deploy a VM or container in the VNet running Azure DevOps agent or GitHub Actions runner.

Option B: Azure DevOps with VNet Integration¶

Use Azure DevOps Managed DevOps Pool with VNet integration (preview).

Option C: GitHub Actions with Private Networking¶

Use GitHub Actions larger runners with Azure private networking (preview).

Option D: Temporary Public Access¶

# Enable public access for deployment
az functionapp update \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --set publicNetworkAccess=Enabled

# Deploy
func azure functionapp publish "$APP_NAME"

# Disable public access
az functionapp update \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --set publicNetworkAccess=Disabled

Troubleshooting¶

Next Steps¶

• Scenario 4: Fixed Outbound IP — Add NAT Gateway for stable egress IP

See Also¶

• Networking Scenarios Overview
• Scenario 2: Private Egress
• Platform: Networking

Sources¶

• Azure Functions networking options (Microsoft Learn)
• Use private endpoints for Azure App Service (Microsoft Learn)
• What is Azure Private Endpoint? (Microsoft Learn)