0

If I am setting up an Azure SQL Database in a vnet which Azure App Service and Azure Function will access. Is using both Subnet Delegation and Service Endpoints the right way to go? I didn't fully understand the documentation.

Regarding subnet delegation, I read this Microsoft article and this stackoverflow post, which stated:

When you delegate a subnet to an Azure service, you allow that service to establish some basic network configuration rules for that subnet, which help the Azure service operate their instances in a stable manner.

That sounds like a good thing but makes me wonder how it worked efficiently w/o subnet delegation.

As for Service Endpoints, I read this Microsoft article, which states:

Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.

Does that mean I cannot reach the Azure SQL Database from my home machine w/a firewall rule?

They both sound like they have the same benefits and I'm struggling to understand the difference. I suppose the larger question is should I enable both for the simple architecture outlined above.

In the Microsoft service endpoints documentation they also mention:

Microsoft recommends use of Azure Private Link for secure and private access to services hosted on Azure platform. For more information, see Azure Private Link.

For some reason that seems like an Azure to on-premise thing.

lcj
  • 1,355
  • 16
  • 37

1 Answers1

0

• You cannot use a ‘Subnet Delegation’ along with a ‘Private endpoint’ since that subnet is delegated for the said service, in your case, the Azure SQL Database. Through a subnet delegation, you can define the NSG association for it, as well as associate multiple delegated subnets to a common NSG. You can also define the IP Address space for the delegated subnet, the route table association with it, the custom DNS entry configuration in Azure DNS as well as define the minimum number of IP Addresses available for that delegated subnet. Similarly, with regards to service endpoint, these stated functions are not available.

• In service endpoint, you do not have control over the routing mechanism as well as the IP address related allotment, reservation, or configuration. Also, managing DNS entries for the resources managed through them and controlling them through a firewall or NAT gateway isn’t required unlike a subnet delegation because all these things are managed by Microsoft Azure’s backbone network on your behalf.

Thus, both have their own features and specifications for enabling you to configure according to your own requirements.

Does that mean I cannot reach the Azure SQL Database from my home machine w/a firewall rule?

Yes, you will have to create a firewall rule to allow the access from on-premises system to Azure SQL Server/Database and configure the service endpoint accordingly to allow the VPN client IP Addresses for accessing the same over public internet.

Also, through Azure private link, you won’t be able to connect from on-premises to Azure as it uses a private IP address and a private DNS zone entry related to it to connect to Azure resources in the same virtual network.

To know more regarding the configuration of Azure service access from on-premises network, kindly refer to the below given link: -

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview#secure-azure-service-access-from-on-premises

Also, refer to the below snapshots regarding the configuration and selection of service endpoint for a particular subnet: -

Service endpoint configuration

Service endpoint configuration - 2

Kartik Bhiwapurkar
  • 4,550
  • 2
  • 4
  • 9