Clarify publicNetworkAccess property effects on APIM Premium V2 VNet-injected instance#128610
Clarify publicNetworkAccess property effects on APIM Premium V2 VNet-injected instance#128610shksin wants to merge 1 commit into
Conversation
…ement instances with virtual network injection. Clarified the effect of the publicNetworkAccess property on API Management instances with virtual network injection.
|
@shksin : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
@shksin : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Learn Build status updates of commit e62fccc:
|
| File | Status | Preview URL | Details |
|---|---|---|---|
| articles/api-management/inject-vnet-v2.md | Details |
articles/api-management/inject-vnet-v2.md
- Line 36, Column 541: [Warning: hard-coded-locale - See documentation]
Link 'https://learn.microsoft.com/en-us/azure/api-management/private-endpoint' contains locale code 'en-us'. For localizability, remove 'en-us' from links to most Microsoft sites. - Line 36, Column 541: [Suggestion: docs-link-absolute - See documentation]
Absolute link 'https://learn.microsoft.com/en-us/azure/api-management/private-endpoint' will be broken in isolated environments. Replace with a relative link.
For more details, please refer to the build report.
Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Clarifies how the publicNetworkAccess property behaves for API Management Premium v2 instances deployed with VNet injection, to reduce confusion when users attempt to disable public access on Internal mode deployments.
Changes:
- Adds a documentation note explaining that
publicNetworkAccessdoesn’t affect VNet-injected (Internal) deployments and that access is controlled via NSG/routing. - Points users to inbound private endpoint documentation for scenarios where
publicNetworkAccessis applicable.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| > * Virtual network injection described in this article is available only for API Management instances in the Premium v2 tier. For networking options in the different tiers, see [Use a virtual network with Azure API Management](virtual-network-concepts.md). | ||
| > * Currently, you can inject a Premium v2 instance into a virtual network only when the instance is **created**. You can't inject an existing Premium v2 instance into a virtual network. However, you can update the subnet settings for injection after the instance is created. | ||
| > * Currently, you can't switch between virtual network injection and virtual network integration for a Premium v2 instance. | ||
| > * The *publicNetworkAccess* property has no effect on API Management instances deployed with virtual network injection. With Internal VNet injection, the gateway endpoint is assigned a private IP address only and has no public IP. Network access is governed entirely by your NSG rules and VNet routing — not by the *publicNetworkAccess* property. The *publicNetworkAccess* property is only relevant for instances that use inbound private endpoints without VNet injection, where a public IP exists and needs to be explicitly disabled. See [Connect privately to API Management using an inbound private endpoint](https://learn.microsoft.com/en-us/azure/api-management/private-endpoint). |
The
publicNetworkAccessproperty is not documented as inapplicable for VNet-injected API Management instances, which causes confusion for users attempting to disable public network access on Premium v2 Internal mode deployments.With Internal VNet injection, the gateway endpoint is assigned a private IP address only and has no public IP. Network access is governed entirely by NSG rules and VNet routing. The
publicNetworkAccessproperty is only relevant for instances using inbound private endpoints without VNet injection, where a public IP exists and needs to be explicitly disabled. Attempting to setpublicNetworkAccess=Disabledon a VNet-injected instance has no effect on network behaviour.This PR adds a Note callout to
inject-vnet-v2.mdandvirtual-network-concepts.mdto clarify this behaviour and direct users to the private endpoint documentation for scenarios wherepublicNetworkAccessis applicable.