Configure your private link

Article
09/24/2024

Configuring an instance of Azure Private Link requires you to:

Create an Azure Monitor Private Link Scope (AMPLS) with resources.
Create a private endpoint on your network and connect it to the scope.
Configure the required access on your Azure Monitor resources.

This article reviews how configuration is done through the Azure portal. It provides an example Azure Resource Manager template (ARM template) to automate the process.

Create a private link connection through the Azure portal

In this section, we review the step-by-step process of setting up a private link through the Azure portal. To create and manage a private link by using the command line or an ARM template, see Use APIs and the command line.

Create an Azure Monitor Private Link Scope

Go to Create a resource in the Azure portal and search for Azure Monitor Private Link Scope.
Select Create.
Select a subscription and resource group.
Give the AMPLS a name. Use a meaningful and clear name like AppServerProdTelem.
Select Review + create.
Let the validation pass and select Create.

Connect Azure Monitor resources

Connect Azure Monitor resources like Log Analytics workspaces, Application Insights components, and data collection endpoints) to your Azure Monitor Private Link Scope (AMPLS).

In your AMPLS, select Azure Monitor Resources in the menu on the left. Select Add.
Add the workspace or component. Selecting Add opens a dialog where you can select Azure Monitor resources. You can browse through your subscriptions and resource groups. You can also enter their names to filter down to them. Select the workspace or component and select Apply to add them to your scope.

Note

Deleting Azure Monitor resources requires that you first disconnect them from any AMPLS objects they're connected to. It's not possible to delete resources connected to an AMPLS.

Connect to a private endpoint

Now that you have resources connected to your AMPLS, create a private endpoint to connect your network. You can do this task in the Azure portal Private Link Center or inside your AMPLS, as done in this example.

In your scope resource, select Private Endpoint connections from the resource menu on the left. Select Private Endpoint to start the endpoint creation process. You can also approve connections that were started in the Private Link Center here by selecting them and selecting Approve.
On the Basics tab, select the Subscription and Resource group
Enter the Name of the endpoint, and Network Interface Name
Select the Region the private endpoint should live in. The region must be the same region as the virtual network to which you connect it.
Select Next: Resource.
On the Resource tab,select the Subscription that contains your Azure Monitor Private Link Scope resource.
For Resource type, select Microsoft.insights/privateLinkScopes.
From the Resource dropdown, select the Private Link Scope you created earlier.
Select Next: Virtual Network.
On the Virtual Network tab, select the Virtual network and Subnet that you want to connect to your Azure Monitor resources.
For Network policy for private endpoints, select edit if you want to apply network security groups or Route tables to the subnet that contains the private endpoint.

In Edit subnet network policy, select the checkboxes next to Network security groups and Route tables, and select Save. For more information, see Manage network policies for private endpoints.
For Private IP configuration, by default, Dynamically allocate IP address is selected. If you want to assign a static IP address, select Statically allocate IP address. Then enter a name and private IP.
Optionally, you can select or create an Application security group. You can use application security groups to group virtual machines and define network security policies based on those groups.
Select Next: DNS.
On the DNS tab, select Yes for Integrate with private DNS zone, and let it automatically create a new private DNS zone. The actual DNS zones might be different from what's shown in the following screenshot.

Note

If you select No and prefer to manage DNS records manually, first finish setting up your private link. Include this private endpoint and the AMPLS configuration. Then, configure your DNS according to the instructions in Azure private endpoint DNS configuration. Make sure not to create empty records as preparation for your private link setup. The DNS records you create can override existing settings and affect your connectivity with Azure Monitor.

Additionally, if you select Yes or No and you're using your own custom DNS servers, you need to set up conditional forwarders for the Public DNS zone forwarders mentioned in Azure private endpoint DNS configuration. The conditional forwarders need to forward the DNS queries to Azure DNS.
Select Next: Tags, then select Review + create.
On the Review + create , once the validation passes select Create.

You've now created a new private endpoint that's connected to this AMPLS.

Configure access to your resources

So far we've covered the configuration of your network. But you should also consider how you want to configure network access to your monitored resources like Log Analytics workspaces, Application Insights components, and data collection endpoints.

Go to the Azure portal. On your resource's menu, find Network Isolation on the left side. This page controls which networks can reach the resource through a private link and whether other networks can reach it or not.

Connected Azure Monitor Private Link Scopes

Here you can review and configure the resource's connections to an AMPLS. Connecting to an AMPLS allows traffic from the virtual network connected to each AMPLS to reach the resource. It has the same effect as connecting it from the scope as we did in the section Connect Azure Monitor resources.

To add a new connection, select Add and select the AMPLS. Select Apply to connect it. Your resource can connect to five AMPLS objects, as mentioned in Consider AMPLS limits.

Virtual networks access configuration: Manage access from outside of a Private Link Scope

The settings on the bottom part of this page control access from public networks, meaning networks not connected to the listed scopes.

If you set Accept data ingestion from public networks not connected through a Private Link Scope to No, clients like machines or SDKs outside of the connected scopes can't upload data or send logs to the resource.

If you set Accept queries from public networks not connected through a Private Link Scope to No, clients like machines or SDKs outside of the connected scopes can't query data in the resource.

That data includes access to logs, metrics, and the live metrics stream. It also includes experiences built on top such as workbooks, dashboards, query API-based client experiences, and insights in the Azure portal. Experiences running outside the Azure portal and that query Log Analytics data also have to be running within the private-linked virtual network.

Use APIs and the command line

You can automate the process described earlier by using ARM templates, REST, and command-line interfaces.

Create and manage Private Link Scopes

To create and manage Private Link Scopes, use the REST API or the Azure CLI (az monitor private-link-scope).

Create an AMPLS with Open access modes: CLI example

The following CLI command creates a new AMPLS resource named "my-scope", with both query and ingestion access modes set to Open.

az resource create -g "my-resource-group" --name "my-scope" -l chinanorth2 --api-version "2021-07-01-preview" --resource-type Microsoft.Insights/privateLinkScopes --properties "{\"accessModeSettings\":{\"queryAccessMode\":\"Open\", \"ingestionAccessMode\":\"Open\"}}"

Create an AMPLS with mixed access modes: PowerShell example

The following PowerShell script creates a new AMPLS resource named "my-scope", with the query access mode set to Open but the ingestion access modes set to PrivateOnly. This setting means it will allow ingestion only to resources in the AMPLS.

# scope details
$scopeSubscriptionId = "ab1800bd-ceac-48cd-...-..."
$scopeResourceGroup = "my-resource-group"
$scopeName = "my-scope"
$scopeProperties = @{
    accessModeSettings = @{
        queryAccessMode     = "Open"; 
        ingestionAccessMode = "PrivateOnly"
    } 
}

# login
Connect-AzAccount -Environment AzureChinaCloud

# select subscription
Select-AzSubscription -SubscriptionId $scopeSubscriptionId

# create private link scope resource
$scope = New-AzResource -Location "chinanorth2" -Properties $scopeProperties -ResourceName $scopeName -ResourceType "Microsoft.Insights/privateLinkScopes" -ResourceGroupName $scopeResourceGroup -ApiVersion "2021-07-01-preview" -Force

Create an AMPLS: ARM template

The following ARM template creates:

An AMPLS named "my-scope", with query and ingestion access modes set to Open.
A Log Analytics workspace named "my-workspace".
And adds a scoped resource to the "my-scope" AMPLS named "my-workspace-connection".

Note

Make sure you use a new API version (2021-07-01-preview or later) for the creation of the AMPLS object (type microsoft.insights/privatelinkscopes as follows). The ARM template documented in the past used an old API version, which results in an AMPLS set with QueryAccessMode="Open" and IngestionAccessMode="PrivateOnly".

{
    "$schema": https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#,
    "contentVersion": "1.0.0.0",
    "parameters": {
        "private_link_scope_name": {
            "defaultValue": "my-scope",
            "type": "String"
        },
        "workspace_name": {
            "defaultValue": "my-workspace",
            "type": "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "microsoft.insights/privatelinkscopes",
            "apiVersion": "2021-07-01-preview",
            "name": "[parameters('private_link_scope_name')]",
            "location": "chinanorth2",
            "properties": {
                "accessModeSettings":{
                    "queryAccessMode":"Open",
                    "ingestionAccessMode":"Open"
                }
            }
        },
        {
            "type": "microsoft.operationalinsights/workspaces",
            "apiVersion": "2020-10-01",
            "name": "[parameters('workspace_name')]",
            "location": "chinanorth2",
            "properties": {
                "sku": {
                    "name": "pergb2018"
                },
                "publicNetworkAccessForIngestion": "Enabled",
                "publicNetworkAccessForQuery": "Enabled"
            }
        },
        {
            "type": "microsoft.insights/privatelinkscopes/scopedresources",
            "apiVersion": "2019-10-17-preview",
            "name": "[concat(parameters('private_link_scope_name'), '/', concat(parameters('workspace_name'), '-connection'))]",
            "dependsOn": [
                "[resourceId('microsoft.insights/privatelinkscopes', parameters('private_link_scope_name'))]",
                "[resourceId('microsoft.operationalinsights/workspaces', parameters('workspace_name'))]"
            ],
            "properties": {
                "linkedResourceId": "[resourceId('microsoft.operationalinsights/workspaces', parameters('workspace_name'))]"
            }
        }
    ]
}

Set AMPLS access modes: PowerShell example

To set the access mode flags on your AMPLS, you can use the following PowerShell script. The following script sets the flags to Open. To use the Private Only mode, use the value "PrivateOnly".

Allow about 10 minutes for the AMPLS access modes update to take effect.

# scope details
$scopeSubscriptionId = "ab1800bd-ceac-48cd-...-..."
$scopeResourceGroup = "my-resource-group-name"
$scopeName = "my-scope"

# login
Connect-AzAccount -Environment AzureChinaCloud

# select subscription
Select-AzSubscription -SubscriptionId $scopeSubscriptionId

# get private link scope resource
$scope = Get-AzResource -ResourceType Microsoft.Insights/privateLinkScopes -ResourceGroupName $scopeResourceGroup -ResourceName $scopeName -ApiVersion "2021-07-01-preview"

# set access mode settings
$scope.Properties.AccessModeSettings.QueryAccessMode = "Open";
$scope.Properties.AccessModeSettings.IngestionAccessMode = "Open";
$scope | Set-AzResource -Force

Set resource access flags

To manage the workspace or component access flags, use the flags [--ingestion-access {Disabled, Enabled}] and [--query-access {Disabled, Enabled}]on az monitor log-analytics workspace or az monitor app-insights component.

Review and validate your private link setup

Follow the steps in this section to review and validate your private link setup.

Review your endpoint's DNS settings

The private endpoint you created should now have five DNS zones configured:

privatelink.monitor.azure.cn
privatelink.oms.opinsights.azure.cn
privatelink.ods.opinsights.azure.cn
privatelink.agentsvc.azure-automation.net
privatelink.blob.core.chinacloudapi.cn

Each of these zones maps specific Azure Monitor endpoints to private IPs from the virtual network's pool of IPs. The IP addresses shown in the following images are only examples. Your configuration should instead show private IPs from your own network.

Important

AMPLS and private endpoint resources created starting December 1, 2021, use a mechanism called Endpoint Compression. Now resource-specific endpoints, such as the OMS, ODS, and AgentSVC endpoints, share the same IP address, per region and per DNS zone. This mechanism means fewer IPs are taken from the virtual network's IP pool, and many more resources can be added to the AMPLS.

Privatelink-monitor-azure-cn

This zone covers the global endpoints used by Azure Monitor, which means endpoints serve requests globally/regionally and not resource-specific requests. This zone should have endpoints mapped for:

in.ai: Application Insights ingestion endpoint (both a global and a regional entry).
api: Application Insights and Log Analytics API endpoint.
live: Application Insights live metrics endpoint.
profiler: Application Insights profiler endpoint.
snapshot: Application Insights snapshot endpoint.
diagservices-query: Application Insights Profiler and Snapshot Debugger (used when accessing profiler/debugger results in the Azure portal).

This zone also covers the resource-specific endpoints for data collection endpoints (DCEs):

<unique-dce-identifier>.<regionname>.handler.control: Private configuration endpoint, part of a DCE resource.
<unique-dce-identifier>.<regionname>.ingest: Private ingestion endpoint, part of a DCE resource.

Log Analytics endpoints