APIM: Public network access disable for Internal Virtual Network Model

[jayendranarumugam]

I have an Azure APIM that configured with Internal Virtual network mode. I dont have any private endpoint configured because my APIM is already private with the network configuration (internal mode). I could see the public access is enabled . I dont know what it means exactly - Does it mean my API deployed inside from APIM or the Gateway URL which i configured with private dns can be accessed public ?

Anyhow just to prevent anything to go public access. I'm trying to change the public access to Disable. But i couldnot able to do that I'm getting the error like below

Disabling all publicNetworkAccess for service: /subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.ApiManagement/service/api-mgmt-01 is not supported if the service does not atleast one approved Private Endpoint Connections.
Code: NotSupported

with 400 Bad request

I used azure cli for the updates. Internally the azure cli used the api-version=2022-08-01

[navba-MSFT]

@jayendranarumugam Thanks for reaching out to us and reporting this issue.

-Blocking all public network access by setting property publicNetworkAccess of API Management service is not enabled during service creation.
-Disabling all publicNetworkAccess for service, is not supported if the service does not atleast one approved Private Endpoint Connections

There is an issue with Azure CLI in enabling the network access for APIM. PR has been filed and it is currently under review: Azure/azure-cli#26380

Seeing the REST API Specs swagger, I see the accepted values are Enabled or Disabled.

In the meantime, You can invoke this REST API where it clearly talks about the --public-network-access accepting the values Enabled or Disabled.

[jayendranarumugam]

Thanks for your message @navba-MSFT , I got the same error even when invoking the REST API. Looking further into the docs i could see the restriction I bumped into because of 2 reasons.

1. Disabling all publicNetworkAccess for service, is not supported if the service does not atleast one approved Private Endpoint Connections
2. To enable private endpoints, the API Management instance can't already be configured with an external or internal

It's a kind of deadlock scenario for me to disable public access. Since the private endpoint is a new feature that got introduced recently. But my APIM got deployed with Vnet Injection (internal) mode before that. So now I can't able to make my APIM truely private access. Because I cannot create private endpoints due to that I cannot switch off the public access.

What would be the possible solution for customers like me, who already had an APIM Deployed internal network config and wants to disable the public access?

[navba-MSFT]

@jayendranarumugam Thanks for getting back. I am adding the service team to assist you further on this.

@adrianhall Could you please provide some pointers on this ?

[adrianhall]

I'm no longer on the API Management team. @vladvino - can you get someone to look at this?

[jayendranarumugam]

@vladvino / @navba-MSFT can you or someone can help me here ?