Clarify that publicNetworkAccess is not applicable for APIM Premium V2 VNet-injected instances#128611
Clarify that publicNetworkAccess is not applicable for APIM Premium V2 VNet-injected instances#128611shksin wants to merge 1 commit into
Conversation
Clarified note on public network access for VNet injection.
|
@shksin : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
@shksin : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Learn Build status updates of commit 869d82c: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Clarifies that publicNetworkAccess does not affect API Management Premium v2 instances using Internal VNet injection, and that inbound exposure is controlled via VNet/NSG configuration.
Changes:
- Add a NOTE explaining
publicNetworkAccessis not applicable for Internal-mode VNet injection - Clarify that NSGs and VNet routing define the network perimeter for VNet-injected instances
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| :::image type="content" source="./media/inject-vnet-v2/vnet-injection.png" alt-text="Diagram of injecting an API Management instance in a virtual network to isolate inbound and outbound traffic." ::: | ||
|
|
||
| > [!NOTE] | ||
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. |
| :::image type="content" source="./media/inject-vnet-v2/vnet-injection.png" alt-text="Diagram of injecting an API Management instance in a virtual network to isolate inbound and outbound traffic." ::: | ||
|
|
||
| > [!NOTE] | ||
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. |
| :::image type="content" source="./media/inject-vnet-v2/vnet-injection.png" alt-text="Diagram of injecting an API Management instance in a virtual network to isolate inbound and outbound traffic." ::: | ||
|
|
||
| > [!NOTE] | ||
| > When using VNet injection (Internal mode), the `publicNetworkAccess` property is not applicable. The network perimeter is controlled by the customer through NSG rules and VNet routing. Setting `publicNetworkAccess` to either `Enabled` or `Disabled` on a VNet-injected instance has no effect on traffic behaviour. |
Users deploying API Management Premium v2 with Internal VNet injection attempt to set
publicNetworkAccess=Disabledexpecting to lock down public access, and are confused when it has no effect on traffic behaviour (and is rejected by ARM atcreation time). The docs do not currently explain that this property is only relevant for instances using inbound private endpoints.
With Internal VNet injection, the gateway endpoint is assigned a private IP address only and has no public IP. The network perimeter is controlled entirely through NSG rules and VNet routing. Setting
publicNetworkAccessto eitherEnabledorDisabledon a VNet-injected instance has no effect on traffic behaviour.