AZ-900 Microsoft Azure Fundamentals Exam

Define Public Endpoints

Define Public Endpoints

Public endpoints are a way to access Azure resources over the internet. They allow users and applications from anywhere to connect to your services. This is useful for making your applications accessible to a wide audience. However, it's important to secure these endpoints to prevent unauthorized access.

Public endpoints use a public IP address, which is reachable from the internet. When you set up a service with a public endpoint, it's like giving it a street address that anyone can find. This makes it easy for users to connect to your service, but it also means you need to be careful about security.

To protect your public endpoints, you can use a network security group (NSG). An NSG acts like a firewall, allowing you to control what kind of traffic can reach your service. You can set rules to allow or deny traffic based on the source, destination, port, and protocol. This helps ensure that only authorized users and applications can access your resources.

When using public endpoints, it's important to ensure that traffic flows correctly. If you change the default routing, you need to make sure that traffic from the internet can still reach your service and that responses can be sent back. This is especially important if you're using a virtual appliance or virtual network gateway.

Public endpoints are often used for services like web applications, APIs, and databases that need to be accessed from the internet. For example, a website hosted on Azure App Service would typically use a public endpoint. The connection string for a public endpoint includes the host name and port number, which are used to connect to the service.

In summary, public endpoints provide a way to make your Azure resources accessible over the internet. While they offer convenience, it's crucial to implement security measures like network security groups to protect your services from unauthorized access.

Security Implications and Best Practices

Security Implications and Best Practices

When exposing a public endpoint for applications in Azure, it's crucial to secure them using Network Security Groups (NSGs). NSGs act as a firewall, filtering network traffic to and from Azure resources. They contain security rules that allow or deny inbound and outbound traffic based on source, destination, port, and protocol. Properly configured NSGs are essential to protect your services from unauthorized access.

For example, a basic rule set for a web service might allow inbound traffic on ports 80 (HTTP) and 443 (HTTPS) from the internet to the service's IP address. If you are using a virtual network injection instance and cannot access app logs from the internet after enabling a log stream public endpoint, you should check your NSG rules to ensure that inbound traffic is allowed. This highlights the importance of regularly reviewing and updating NSG rules to maintain security.

Azure Private Link provides a way to access Azure services privately within your virtual network, using private endpoints. Private endpoints use a private IP address from your VNet to connect to services, effectively bringing the service into your VNet. This eliminates the need to expose your virtual network to the public internet to consume services on Azure. This approach significantly enhances security by keeping traffic within the Azure backbone network.

Azure Virtual Network Manager offers a centralized solution for managing and securing virtual networks at scale. It uses security admin rules to enforce security policies across your organization's virtual networks. These rules take precedence over NSG rules, allowing organizations to enforce core policies while still enabling teams to customize NSGs at the subnet and NIC levels. This provides a layered approach to security, ensuring consistent protection across the entire network.

Virtual network service endpoints provide secure and direct connectivity to Azure services over an optimized route on the Azure backbone network. When enabled, the source IP addresses of resources in your virtual network's subnet switch from public IPv4 addresses to the virtual network's private IP addresses for traffic to Azure services. This can cause issues with IP firewalls set to public IPv4 addresses, so careful planning is needed. Service endpoints always take service traffic directly from your virtual network to the service on the Microsoft Azure backbone network.

Define Private Endpoints

Define Private Endpoints

Private endpoints provide a secure way to connect to Azure services from within your virtual network (VNet). Instead of using public IP addresses, private endpoints use private IP addresses from your VNet, ensuring that traffic between your VNet and the Azure service stays within the Microsoft Azure network. This enhances security by limiting exposure to the public internet. Private endpoints are a key component of Azure's private link service, which allows you to access Azure services as if they were part of your VNet.

When setting up a private endpoint, you'll need to configure network policies for the subnet where the endpoint resides. By default, network policies are disabled for a subnet, but you can enable them for network security groups (NSGs), user-defined routes (UDRs), or both. Enabling these policies allows you to control traffic flow to and from the private endpoint. For example, you can use UDRs to ensure that traffic to the private endpoint goes through a firewall or virtual appliance, adding an extra layer of security. It's important to note that the prefix size of UDRs must be equal to or smaller than the virtual network address space to invalidate the default route of the private endpoint.

To create a private endpoint, you typically start by disabling public access to the Azure resource you want to secure. Then, you create a private endpoint within your VNet, selecting the appropriate subscription, resource group, and subnet. The private endpoint is associated with a specific Azure resource, such as an Azure Managed Grafana workspace or an Azure SQL Database. You also have the option to integrate the private endpoint with a private DNS zone, which allows you to resolve the private IP address of the service using a private DNS server. This ensures that your applications within the VNet can access the service using its private IP address.

Private endpoints can also be managed within services like Azure Stream Analytics. In this case, you create a managed private endpoint within your Stream Analytics cluster to connect to input and output resources that are behind a firewall or VNet. This allows your Stream Analytics jobs to securely access resources like Azure Event Hub or Azure SQL Database. After creating the private endpoint, you need to approve the connection from the target resource. Once approved, any job running in your Stream Analytics cluster can access the resource through the private endpoint.

In summary, private endpoints are a crucial tool for enhancing the security of your Azure resources. They allow you to access Azure services using private IP addresses within your VNet, reducing exposure to the public internet. By configuring network policies and integrating with private DNS zones, you can create a secure and controlled environment for your cloud resources. Understanding how to create and manage private endpoints is essential for building secure and compliant Azure solutions.

Use Cases for Public and Private Endpoints

Use Cases for Public and Private Endpoints

Public endpoints are designed to be accessible from the public internet, allowing users and services from anywhere to connect. Azure Traffic Manager uses public endpoints to direct traffic to various application deployments. These endpoints can be Azure-based services, external services (on-premises or with other providers), or even nested configurations for complex routing. Public endpoints are essential for applications that need to be globally accessible.

Azure Endpoints

Azure endpoints within Traffic Manager are specifically for services hosted in Azure. These include PaaS cloud services, Web Apps, Web App Slots, and Public IP Address resources. When using Azure endpoints, Traffic Manager can detect when a Web App is stopped or started, adjusting its status accordingly. This ensures that traffic is only directed to active and healthy services.

External Endpoints

External endpoints are used for services outside of Azure, including on-premises services or those hosted with other providers. They can be specified using IPv4/IPv6 addresses or Fully Qualified Domain Names (FQDNs). External endpoints allow for hybrid scenarios, where applications can span across different environments. They also enable health checks without requiring a DNS name, which can reduce DNS lookup latency.

Private endpoints, on the other hand, provide secure access to Azure services within a virtual network. They use private IP addresses, ensuring that traffic stays within the network and is not exposed to the public internet. This is crucial for enhancing security and controlling access to sensitive resources. Private endpoints are often used when public access is not desired or when strict network security is required.

Private Endpoint Network Policies

Network policies for private endpoints, such as Network Security Groups (NSGs) and User-Defined Routes (UDRs), are disabled by default on a subnet. Enabling these policies allows for more granular control over network traffic. For example, you can use UDRs to ensure that traffic to a private endpoint goes through a firewall or virtual appliance. This adds an extra layer of security and control.

Private Access Scenarios

Private endpoints are particularly useful when you want to disable public access to a service, such as an Azure Managed Grafana workspace. By setting up a private endpoint, you can ensure that only traffic from within your virtual network can access the service. This is a key security measure for protecting sensitive data and resources.

Configuration of Public and Private Endpoints

Configuration of Public and Private Endpoints

Public endpoints allow access to your Azure resources from the internet, making them accessible to anyone. By default, when you create an Azure resource, like an Azure Managed Grafana workspace, public access is enabled. This means that traffic from any network can reach your resource. However, for enhanced security, you might want to restrict this access.

Private endpoints, on the other hand, provide a way to access your Azure resources using a private IP address within your virtual network. This means that only traffic originating from within your virtual network or connected networks can reach the resource. To set up a private endpoint, you first need to disable public access to your resource. This ensures that all traffic must go through the private endpoint, increasing security by limiting access to only specific networks.

To create a private endpoint, you need to specify a few key details. First, you select the Azure subscription and resource group where the endpoint will reside. The private endpoint must be in the same subscription and region as your virtual network. You also need to provide a name for the endpoint and the network interface. Then, you choose the virtual network and subnet where the private endpoint will be deployed. Finally, you can configure DNS settings to integrate the private endpoint with a private DNS zone, which helps with name resolution within your network.

When configuring private endpoints, you can also manage network policies. By default, network policies are disabled for a subnet, but you can enable them to use features like network security groups and user-defined routes. These policies allow you to control the traffic flow to and from the private endpoint. For example, you can use a network security group to define rules that allow or deny traffic based on source and destination IP addresses. You can also use user-defined routes to ensure that traffic goes through a firewall or virtual appliance before reaching the private endpoint.

In summary, configuring public and private endpoints is crucial for managing access to your Azure resources. Public endpoints offer broad accessibility, while private endpoints provide secure access within your virtual network. By disabling public access and setting up private endpoints, you can significantly enhance the security of your Azure environment. Understanding how to configure these endpoints, along with network policies, is essential for managing your Azure resources effectively.

Conclusion

This section covered the critical concepts of public and private endpoints in Azure. Public endpoints provide accessibility over the internet, while private endpoints offer secure access within a virtual network. We explored the security implications of each, emphasizing the use of Network Security Groups (NSGs) and Azure Private Link for enhanced protection. We also discussed the use cases for both types of endpoints, highlighting when to use each based on security, performance, and accessibility needs. Finally, we reviewed the configuration steps for both public and private endpoints, including network settings, DNS configurations, and access controls. Understanding these concepts is essential for building secure and efficient Azure solutions.