Skip to content

api-management-using-with-vnet.md

Latest commit

 

History

History
124 lines (79 loc) · 8.6 KB

api-management-using-with-vnet.md

File metadata and controls

124 lines (79 loc) · 8.6 KB
title Deploy Azure API Management Instance to External Virtual Network
description Learn how to deploy (inject) your Azure API instance to a virtual network in external mode and access API backends through it.
services api-management
author dlepow
ms.service azure-api-management
ms.topic how-to
ms.date 01/08/2026
ms.author danlep

Deploy your Azure API Management instance to a virtual network - external mode

[!INCLUDE premium-dev.md]

You can deploy Azure API Management inside an Azure virtual network to access backend services within the network. For virtual network connectivity options, requirements, and considerations, see:

This article explains how to set up virtual network connectivity for your API Management Developer tier or Premium tier instance in the external mode. In this mode, the developer portal, API gateway, and other API Management endpoints are accessible from the public internet, and backend services can be located in the network.

:::image type="content" source="media/api-management-using-with-vnet/api-management-vnet-external.png" alt-text="Diagram showing API Management in an external virtual network.":::

For configurations specific to the internal mode, where the endpoints are accessible only within the virtual network, see Deploy your Azure API Management instance to a virtual network - internal mode.

[!INCLUDE updated-for-az]

[!INCLUDE api-management-service-update-behavior]

[!INCLUDE api-management-virtual-network-prerequisites]

Enable virtual network connection

Enable virtual network connectivity by using the Azure portal

  1. Go to the Azure portal to find your API management instance. Search for and select API Management services.

  2. Select your API Management instance.

  3. In the sidebar menu, under Deployment + infrastructure, select Network.

  4. Select the External access type. :::image type="content" source="media/api-management-using-with-vnet/api-management-menu-vnet.png" alt-text="Screenshot of network settings in the Azure portal.":::

  5. In the list of locations (regions) where your API Management service is provisioned:

    1. Choose a Location.
    2. Select Virtual network, Subnet, and (optionally) Public IP address.

    • The virtual network list is populated with virtual networks available in your Azure subscriptions, set up in the region you're configuring.

      :::image type="content" source="media/api-management-using-with-vnet/api-management-using-vnet-select.png" alt-text="Screenshot showing virtual network configuration in the portal.":::

  6. Select Apply. The Network page of your API Management instance is updated with your new virtual network and subnet choices.

  7. Select Verify to confirm that the prerequisites are met and the API Management service can successfully update.

  8. Continue configuring virtual network settings for the remaining locations of your API Management instance.

  9. In the top navigation bar, select Save.

Enable connectivity by using a Resource Manager template

[!INCLUDE api-management-recommended-nsg-rules]

Connect to a web service hosted within a virtual network

After you connect your API Management service to the virtual network, you can access backend services within the virtual network just as you do public services. When creating or editing an API, type the local IP address or the host name (if a DNS server is configured for the virtual network) of your web service into the Web service URL field.

:::image type="content" source="media/api-management-using-with-vnet/api-management-using-vnet-add-api.png" alt-text="Screenshot showing how to add API from virtual network in the portal.":::

Custom DNS server setup

In external virtual network mode, Azure manages the DNS by default. You can optionally configure a custom DNS server.

The API Management service depends on several Azure services. When API Management is hosted in a virtual network with a custom DNS server, it needs to resolve the hostnames of those Azure services.

Important

If you plan to use custom DNS servers for the virtual network, set them up before deploying an API Management service into the virtual network. Otherwise, you need to update the API Management service each time you change the DNS servers by running the Apply Network Configuration Operation. You can also apply a network configuration on the Network/Network status blade in the Azure portal.

Routing

  • A load-balanced public IP address (VIP) is reserved to provide access to the API Management endpoints and resources outside the virtual network.
    • You can find the public VIP on the Overview/Essentials blade in the Azure portal.

For more information and considerations, see IP addresses of Azure API Management.

[!INCLUDE api-management-virtual-network-vip-dip]

[!INCLUDE api-management-virtual-network-forced-tunneling]

Common network configuration issues

This section has moved. See Virtual network configuration reference.

[!INCLUDE api-management-virtual-network-troubleshooting]

Related content

Learn more about: