Skip to content

Network design

Network design determines whether users and data sources can reach the service. Finalize it before deployment to avoid address, route, DNS, and certificate rework.

Choose the access model

Use private access when clients must remain on private Azure, peered, VPN-connected, or ExpressRoute-connected networks. Use public access only when internet-reachable endpoints are allowed by your security policy.

Authentication and TLS are required in both models.

Private-access checklist

  • Client and platform address spaces do not overlap.
  • The Private Endpoint subnet has available addresses.
  • Network policy permits a Private Endpoint in that subnet.
  • A route exists from every client network to the endpoint.
  • The DNS design covers Azure-native and hybrid clients.
  • The DNS owner can create the required records or forwarding rules.
  • The certificate authority can issue a certificate for the deployment hostnames.
  • Firewalls permit only required client-to-service connections.

Public-access checklist

  • Internet exposure is approved.
  • The authoritative public DNS owner is identified.
  • The selected domain and certificate names match.
  • Source restrictions or proxy controls are documented.
  • Users will still authenticate with individual accounts.

Separate the failure domains

Troubleshoot in this order:

  1. Routing and Private Endpoint provide the network path.
  2. DNS maps the service hostname to the intended endpoint.
  3. TLS verifies the hostname and certificate trust.
  4. Authentication verifies the user or client.

Do not replace a service hostname with an IP address to bypass DNS. The TLS certificate is issued for hostnames, not for an arbitrary endpoint IP.