Skip to content

Commit 1754842

Browse files
learn-build-service-prod[bot]learn-build-service-prod[bot]
authored
Merge pull request #312706 from MicrosoftDocs/main
Auto Publish – main to live - 2026-03-06 06:00 UTC
2 parents 0c10638 + 25d8513 commit 1754842

7 files changed

Lines changed: 556 additions & 260 deletions

File tree

‎articles/azure-netapp-files/azure-netapp-files-create-volumes.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: azure-netapp-files
55
author: b-hchen
66
ms.service: azure-netapp-files
77
ms.topic: how-to
8-
ms.date: 10/07/2025
8+
ms.date: 02/05/2026
99
ms.author: anfdocs
1010
# Customer intent: As a cloud architect, I want to create an NFS volume in Azure NetApp Files, so that I can support my application’s data management requirements and ensure optimized performance through proper version selection and configuration.
1111
---
@@ -31,7 +31,9 @@ This article shows you how to create an NFS volume. For SMB volumes, see [Create
3131

3232
>[!NOTE]
3333
>[!INCLUDE [Note about Kerberos non-support for other LDAP services](includes/kerberos-other-servers.md)]
34-
34+
35+
* You must ensure that the Active Directory connector has the required permissions to set the encryption style of the volume.
36+
3537
## Considerations
3638

3739
* Deciding which NFS version to use

‎articles/container-apps/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,6 +470,8 @@ items:
470470
href: mtls.md
471471
- name: Integrate with Azure Front Door
472472
href: how-to-integrate-with-azure-front-door.md
473+
- name: Use Azure Front Door and Private Link
474+
href: front-door-custom-virtual-network-private-link.md
473475
- name: Languages and runtimes
474476
items:
475477
- name: .NET

‎articles/container-apps/front-door-custom-virtual-network-private-link.md‎

Lines changed: 274 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
---
2+
title: Use Azure Front Door Premium with a custom virtual network and Private Link in Azure Container Apps
3+
description: Learn how to deploy an Azure Container Apps environment in a custom virtual network with internal ingress and expose it securely through Azure Front Door Premium with Private Link.
4+
#customer intent: As a cloud architect, I want to deploy Azure Container Apps in a secure custom virtual network so that I can route inbound traffic privately through Azure Front Door Premium with Private Link.
5+
author: kkaushal24011982
6+
ms.author: kkaushal
7+
ms.reviewer: cshoe
8+
ms.service: azure-container-apps
9+
ms.custom:
10+
- build-2025
11+
ms.topic: how-to
12+
ms.date: 03/05/2026
13+
---
14+
15+
# Use Azure Front Door Premium with a custom virtual network and Private Link
16+
17+
In this article, you learn how to deploy an Azure Container Apps environment in a custom virtual network with an internal virtual IP (VIP) and public network access disabled. You then expose the environment securely through Azure Front Door Premium by using Private Link and private endpoints. This configuration provides a secure inbound path to your container apps while supporting zone redundancy.
18+
19+
> [!IMPORTANT]
20+
> There are [more charges](./private-endpoints-with-dns.md#billing) for enabling private endpoints in both the Dedicated and Consumption plans.
21+
22+
## Prerequisites
23+
24+
- Azure account with an active subscription.
25+
- If you don't have one, [create one for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).
26+
27+
- This feature only supports workload profile environments.
28+
29+
- Make sure the `Microsoft.Cdn` resource provider is registered for your subscription.
30+
1. Sign in to the [Azure portal](https://portal.azure.com).
31+
1. Go to your subscription page and select **Settings** > **Resource providers**.
32+
1. Select **Microsoft.Cdn** from the provider list.
33+
1. Select **Register**.
34+
35+
## Architecture
36+
37+
The workload profiles environment type supports the combination of custom virtual network integration, private endpoints, and zone redundancy.
38+
39+
The following list describes how inbound traffic flows from the user to your container app:
40+
41+
1. A user connects to the Azure Front Door edge.
42+
43+
1. Azure Front Door forwards traffic to the origin over Private Link.
44+
45+
1. Traffic arrives at the private endpoint IP address in the workload virtual network (for example, `10.0.2.4`).
46+
47+
1. The private endpoint connects to the internal Container Apps environment.
48+
49+
1. Within the virtual network, the environment uses an internal load balancer (ILB) VIP (for example, `10.0.0.165`) to reach the ingress controller.
50+
51+
1. The ingress controller routes traffic to the correct container app, revision, and replica based on host headers and ingress configuration.
52+
53+
### Design considerations
54+
55+
Keep the following design decisions in mind when you plan your deployment:
56+
57+
| Decision | Recommendation | Reason |
58+
|----------|----------------|--------|
59+
| Container Apps subnet size | `/23` | Provides room for scaling replicas and nodes. |
60+
| Private endpoint subnet | Separate, nondelegated subnet (for example, `/24`) | Private endpoints can't share a delegated subnet. |
61+
| Front Door SKU | Premium | Required for Private Link origins. |
62+
63+
## Create the virtual network and subnets
64+
65+
Create a virtual network with two subnets: one delegated to the Container Apps environment and one for private endpoints.
66+
67+
1. Search for **Virtual networks** in the top search bar.
68+
69+
1. Select **Virtual networks** in the search results.
70+
71+
1. Select **Create**.
72+
73+
1. In *Create virtual network*, in the *Basics* tab, enter the following values.
74+
75+
| Setting | Action |
76+
|---|---|
77+
| Subscription | Select your Azure subscription. |
78+
| Resource group | Select **Create new** and enter a name (for example, **my-container-apps**). |
79+
| Virtual network name | Enter a name (for example, **my-vnet**). |
80+
| Region | Select your target region. |
81+
82+
1. Select the **IP addresses** tab.
83+
84+
1. Configure the address space (for example, `10.0.0.0/16`).
85+
86+
1. Create two subnets with the following configuration:
87+
88+
| Subnet name | Address range | Delegation | Purpose |
89+
|---|---|---|---|
90+
| **container-apps-subnet** | For example, `10.0.0.0/23` | `Microsoft.App/environments` | Hosts the Container Apps environment. |
91+
| **private-endpoint-subnet** | For example, `10.0.2.0/24` | None | Hosts private endpoints. |
92+
93+
1. Select **Review + create**, and then select **Create**.
94+
95+
## Create the container app and environment
96+
97+
Create a Container Apps environment with internal ingress in your custom virtual network, and then deploy a container app to the environment.
98+
99+
### Create the container app
100+
101+
1. Search for **Container Apps** in the top search bar.
102+
103+
1. Select **Container Apps** in the search results.
104+
105+
1. Select **Create**.
106+
107+
1. In *Create Container App*, use the *Basics* tab to enter the following values.
108+
109+
| Setting | Action |
110+
|---|---|
111+
| Subscription | Select your Azure subscription. |
112+
| Resource group | Select the resource group you created (for example, **my-container-apps**). |
113+
| Container app name | Enter a name (for example, **my-container-app**). |
114+
| Deployment source | Select **Container image**. |
115+
| Region | Select the same region as your virtual network. |
116+
117+
1. In *Container Apps Environment*, select **Create new environment**.
118+
119+
### Configure the environment
120+
121+
1. In *Create Container Apps Environment*, in the *Basics* tab, enter the following values.
122+
123+
| Setting | Action |
124+
|---|---|
125+
| Environment name | Enter a name (for example, **my-environment**). |
126+
| Zone redundancy | Select **Enabled** (if available and required). |
127+
128+
1. Select the **Workload profiles** tab, and add at least one workload profile (for example, **D4**). Set the autoscaling instance count range.
129+
130+
1. Select the **Networking** tab and enter the following values.
131+
132+
| Setting | Action |
133+
|---|---|
134+
| Public network access | Select **Disable: Block all incoming traffic from the public internet**. |
135+
| Use your own virtual network | Select **Yes**. |
136+
| Virtual network | Select the virtual network you created (for example, **my-vnet**). |
137+
| Infrastructure subnet | Select the delegated subnet (for example, **container-apps-subnet**). |
138+
| Virtual IP | Select **Internal**. |
139+
| Enable private endpoints | Select **Yes**. |
140+
| Private endpoint subnet | Select **private-endpoint-subnet**. |
141+
| DNS | Select **Azure Private DNS zone**. |
142+
143+
1. Select **Create** to create the environment.
144+
145+
### Configure and deploy the container app
146+
147+
1. On *Create Container App*, select the **Container** tab.
148+
149+
1. Select **Use quickstart image** for testing, or clear the checkbox and provide your own container image.
150+
151+
> [!NOTE]
152+
> The quickstart image enables ingress automatically. If you don't use the quickstart image, make sure you enable ingress so that your container app can accept traffic from Azure Front Door through the private endpoint.
153+
154+
1. Select **Review + create**, and then select **Create**.
155+
156+
## Verify the environment deployment
157+
158+
Before you create the Azure Front Door profile, confirm that the environment is configured correctly.
159+
160+
1. Go to the resource group you created and open the **Container Apps environment** resource.
161+
162+
1. Select **Networking**.
163+
164+
1. Verify the following settings:
165+
166+
| Setting | Expected value |
167+
|---|---|
168+
| Public network access | **Disabled** |
169+
| Virtual IP | **Internal** (note the IP address) |
170+
| Private endpoint connections | At least one connection exists and is approved |
171+
172+
## Create the Azure Front Door Premium profile
173+
174+
Create an Azure Front Door Premium profile to route inbound traffic to your internal container app over Private Link.
175+
176+
1. Search for **Front Door and CDN profiles** in the top search bar.
177+
178+
1. Select **Front Door and CDN profiles** in the search results.
179+
180+
1. Select **Create**.
181+
182+
1. Select **Azure Front Door** and **Quick Create**.
183+
184+
1. Select the **Continue to create a Front Door** button.
185+
186+
1. In *Create a Front Door profile*, in the *Basics* tab, enter the following values.
187+
188+
| Setting | Action |
189+
|---|---|
190+
| Resource group | Select the resource group you created (for example, **my-container-apps**). |
191+
| Name | Enter a profile name (for example, **my-afd-profile**). |
192+
| Tier | Select **Premium**. Private Link isn't supported for origins on the Standard tier. |
193+
| Endpoint name | Enter an endpoint name (for example, **my-afd-endpoint**). |
194+
| Origin type | Select **Container Apps**. |
195+
| Origin host name | Select your container app environment. |
196+
| Enable private link service | Enable this setting. |
197+
| Region | Select the region of your container app. |
198+
| Target sub resource | Select **managedEnvironments**. |
199+
| Request message | Enter a message (for example, **AFD Private Link Request**). |
200+
201+
1. Select **Review + create**, and then select **Create**.
202+
203+
1. After the deployment finishes, select **Go to resource** and find your *Endpoint hostname*. Your hostname looks like the following example. Make a note of this hostname.
204+
205+
```text
206+
my-afd-endpoint.<HASH>.b01.azurefd.net
207+
```
208+
209+
## Approve the private endpoint connection
210+
211+
After you deploy Azure Front Door, approve the incoming private endpoint connection request from the Container Apps environment.
212+
213+
1. Go to the **Container Apps environment** resource in the Azure portal.
214+
215+
1. Select **Settings** > **Networking**.
216+
217+
1. Select the link for private endpoint connection requests.
218+
219+
1. Select the pending connection with the description you provided (for example, **AFD Private Link Request**).
220+
221+
1. Select **Approve**.
222+
223+
1. Wait for the status to change to **Approved**.
224+
225+
> [!NOTE]
226+
> Azure Front Door has a known problem where it might create multiple private endpoint connection requests. Approve each request with the matching description.
227+
228+
## Validate the connection
229+
230+
After you approve the private endpoint connection, verify that traffic reaches your container app through Azure Front Door.
231+
232+
1. Browse to the Azure Front Door endpoint hostname you recorded earlier.
233+
234+
1. Verify that your application loads correctly.
235+
236+
1. Confirm that direct access to the container app's default domain fails, since public access is disabled.
237+
238+
1. Verify that DNS resolution for the environment domain resolves to the private IP address within the virtual network.
239+
240+
> [!NOTE]
241+
> Global deployment might take a few minutes to propagate. If you don't see the expected output, wait a few minutes and then refresh.
242+
243+
## Troubleshoot common problems
244+
245+
The following table describes common problems and their resolutions:
246+
247+
| Problem | Resolution |
248+
|---|---|
249+
| Subnet validation errors | Ensure the Container Apps subnet is delegated to `Microsoft.App/environments` and meets the [minimum size requirements](./custom-virtual-networks.md#subnet). |
250+
| Private endpoint creation failure | Ensure the private endpoint is in a separate, nondelegated subnet. |
251+
| Front Door origin returns an error | Verify that the private endpoint connection is approved in the Container Apps environment. It might take a few minutes for the connection to become active. |
252+
| Container app is publicly accessible | Verify that **Public network access** is set to **Disabled** in the Container Apps environment networking settings. |
253+
254+
## Clean up resources
255+
256+
If you don't plan to continue using this application, you can delete the container app and all the associated services by removing the resource group.
257+
258+
1. Select your resource group from the *Overview* section.
259+
1. Select the **Delete resource group** button at the top of the resource group *Overview*.
260+
1. Enter the resource group name in the confirmation dialog.
261+
1. Select **Delete**.
262+
263+
The process to delete the resource group can take a few minutes.
264+
265+
> [!TIP]
266+
> Having problems? Let us know on GitHub by opening an issue in the [Azure Container Apps repo](https://github.com/microsoft/azure-container-apps).
267+
268+
## Related content
269+
270+
- [Networking in Azure Container Apps](./networking.md)
271+
- [Use a private endpoint with an Azure Container Apps environment](./how-to-use-private-endpoint.md)
272+
- [Create a private link to an Azure Container App with Azure Front Door](./how-to-integrate-with-azure-front-door.md)
273+
- [Virtual network configuration](./custom-virtual-networks.md)
274+
- [Private endpoints and DNS](./private-endpoints-with-dns.md)

‎articles/cost-management-billing/reservations/view-reservations.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ You can view, manage, and delegate permissions to reservations by using built-in
6464
- **Enterprise Agreement**: Users with the Enterprise Agreement Purchaser role or higher
6565
- **Microsoft Partner Agreement**: Not supported
6666

67-
To purchase a reservation, Enterprise Agreement admins or billing profile owners must have Owner or Reservations Purchaser access on at least one Enterprise Agreement or Microsoft Customer Agreement subscription. This option is useful for enterprises that want a centralized team to purchase reservations. For more information, see [Buy an Azure reservation](prepare-buy-reservation.md).
67+
To purchase a reservation, Enterprise Agreement admins or billing profile owners must have Owner or Reservation Purchaser access on at least one Enterprise Agreement or Microsoft Customer Agreement subscription. This option is useful for enterprises that want a centralized team to purchase reservations. For more information, see [Buy an Azure reservation](prepare-buy-reservation.md).
6868

6969
### View and manage reservations as a Billing Admin
7070

@@ -92,7 +92,7 @@ Add a user as billing administrator to an Enterprise Agreement or a Microsoft Cu
9292
Azure provides four reservation-specific RBAC roles with different permission levels:
9393

9494
- **Reservations Administrator**: Users with this role can manage one or more reservations in their Microsoft Entra tenant (directory). They can also [delegate RBAC roles](/azure/role-based-access-control/role-assignments-portal) to other users.
95-
- **Reservations Purchaser**: Users with this role can purchase reservations with a specified subscription (even non-subscription owners).
95+
- **Reservation Purchaser**: Users with this role can purchase reservations with a specified subscription (even non-subscription owners).
9696
- **Reservations Contributor**: Users with this role can manage one or more reservations in their Microsoft Entra tenant (directory) but can't delegate RBAC roles to other users.
9797
- **Reservations Reader**: Users with this role have read-only access to one or more reservations in their Microsoft Entra tenant (directory).
9898

@@ -131,7 +131,7 @@ If you have reservation-specific RBAC roles (Reservations Administrator, Purchas
131131

132132
In this section, you learn how to:
133133

134-
- Delegate the Reservations Purchaser role to a specific subscription.
134+
- Delegate the Reservation Purchaser role to a specific subscription.
135135
- Delegate the Reservations Administrator, Contributor, or Reader roles to a specific reservation.
136136
- Delegate the Reservations Administrator, Contributor, or Reader roles to all reservations.
137137

@@ -142,7 +142,7 @@ Users and groups who gain the ability to purchase, manage, or view reservations
142142
143143
#### Delegate the Reservation Purchaser role to a specific subscription
144144

145-
To delegate the Reservations Purchaser role to a specific subscription, first make sure you have elevated access. Then, follow these steps:
145+
To delegate the Reservation Purchaser role to a specific subscription, first make sure you have elevated access. Then, follow these steps:
146146

147147
1. Go to **Home** > **Reservations** to see all reservations in the tenant.
148148
2. To make modifications to the reservation, add yourself as an owner of the reservation order by using the **Access control (IAM)** option.

‎articles/data-factory/how-to-upgrade-your-azure-data-factory-pipelines-to-fabric-data-factory.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,8 @@ After the migration completes, go to the folder you selected in the Fabric works
119119
120120
After migration completes, validate the pipelines in the Fabric Data Factory experience.
121121

122+
> [!VIDEO https://learn-video.azurefd.net/vod/player?id=4704fb66-2ce2-44a6-a024-4a00c0963b42]
123+
122124
## Migration behavior
123125

124126
- Pipelines migrate into a Fabric Data Factory workspace.

0 commit comments

Comments
 (0)