Update deployment instructions for network-secured Azure Functions

Author: ggailey777

articles/azure-functions/functions-create-vnet.md

@@ -237,7 +237,7 @@ For more information about identity-based connections, see [Identity-based conne
 ## Deploy a Service Bus trigger and HTTP trigger
 
 > [!IMPORTANT]
-> Because public access is disabled, the SCM deployment site isn't reachable. You must temporarily re-enable public access so that Deployment Center can deploy your code. For production workloads, use a [secured deployment method](configure-networking-how-to.md#secured-deployments) such as [self-hosted](/azure/devops/pipelines/agents/docker) agents deployed into a subnet on the virtual network.
+> Because public access is disabled, the SCM deployment site isn't reachable. You must temporarily re-enable public access so that Deployment Center can deploy your code. For production workloads, deploy from a [self-hosted](/azure/devops/pipelines/agents/docker) agent deployed into a subnet on the virtual network, or connect your development machine by using a [point-to-site VPN](../vpn-gateway/point-to-site-about.md). For more information, see [Secured virtual networks](functions-deployment-technologies.md#secured-virtual-networks).
 
 1. In your function app, in the menu under **Settings**, select **Networking**. Set **Public network access** to **Enabled from select virtual networks and IP addresses**, and then select **Save**.
 

articles/azure-functions/functions-deployment-technologies.md

@@ -3,7 +3,7 @@ title: Deployment technologies in Azure Functions
 description: Learn the different ways you can deploy code to Azure Functions.
 ms.custom: vs-azure, vscode-azure-extension-update-not-needed, build-2023, build-2024
 ms.topic: concept-article
-ms.date: 01/15/2026
+ms.date: 04/12/2026
 ---
 
 # Deployment technologies in Azure Functions
@@ -111,7 +111,7 @@ By default, both [Azure Functions Core Tools](functions-run-local.md) and the [A
 
 When you build apps remotely on Linux, they [run from the deployment package](run-functions-from-deployment-package.md).
 
-When deploying to the Flex Consumption plan, you don't need to set any application settings to request a remote build. You instead pass a remote build parameter when you start deployment. How you pass this parameter depends on the deployment tool you're using. For Core Tools and Visual Studio Code, a remote build is always requested when deploying a Python app.
+When deploying to the Flex Consumption plan, you don't need to set any application settings to request a remote build. You instead pass a remote build parameter when you start deployment. How you pass this parameter depends on the deployment tool you're using. For Core Tools and Visual Studio Code, a remote build is always requested when deploying a Python app. For more information, see [Deployment](flex-consumption-plan.md#deployment).
 
 ---
 
@@ -128,6 +128,17 @@ Package-based deployment methods store the package in the storage account associ
 
 [!INCLUDE [functions-storage-access-note](../../includes/functions-storage-access-note.md)]
 
+### Secured virtual networks
+
+When your function app has [private endpoints](functions-networking-options.md#private-endpoints) enabled and public network access is disabled, the `scm` (Kudu) deployment site isn't publicly reachable. When the storage account used by the function app is also secured behind private endpoints, technologies that must access storage are similarly blocked. Because of these restrictions, the deployment technologies described in this article can't reach a fully network-secured function app from outside the virtual network.
+
+To deploy code to a network-secured function app, your deployment tooling must have connectivity to the virtual network. You can achieve this connectivity in these ways:
+
++ Deploy from a [self-hosted build agent](/azure/devops/pipelines/agents/docker) or [GitHub Actions runner](https://docs.github.com/actions/hosting-your-own-runners/about-self-hosted-runners) running in a subnet on your virtual network.
++ Connect your development machine to the virtual network by using a [point-to-site VPN](../vpn-gateway/point-to-site-about.md) or [ExpressRoute](../expressroute/expressroute-introduction.md).
+
+For more information about configuring your function app in a virtual network, see [How to configure Azure Functions with a virtual network](configure-networking-how-to.md).
+
 ## Deployment technology details
 
 The following deployment methods are available in Azure Functions. To determine which technologies each hosting plan supports, refer to the [deployment technology availability](#deployment-technology-availability) table.