How to restrict access for an existing Azure Container App to only be accessible via Azure VPN Gateway (Point-to-Site)

Hello @Abdelrhman Goma

To limit access to your current Azure Container Apps so that only users connecting through Azure VPN Gateway (Point-to-Site) can reach them, you should update the public network access settings. Here’s how you can do this:

1. Disable Public Network Access: Set public network access to "Disabled" on your container apps to prevent any traffic from the public internet.
2. Enable Private Endpoints: Once public access is disabled, configure private endpoints. This ensures the apps are accessible only through your Azure Virtual Network (VNet), including the VPN Gateway.
3. Set Ingress Rules: Adjust ingress settings so that only traffic from within the VNet is accepted, allowing access solely to clients connected via VPN.
4. Application Gateway & WAF: If you’re looking for more advanced scenarios, consider placing your Container Apps behind an Application Gateway and utilizing its Web Application Firewall (WAF) capabilities for additional security layers.

These steps allow you to restrict access as required without needing to recreate or redeploy your container apps.

References:

• Networking in Azure Container Apps environment
• Use a private endpoint with an Azure Container Apps environment (azure-portal)
• Protect Azure Container Apps with Web Application Firewall on Application Gateway

Hope this helps!

@Abdelrhman Goma

I wanted to follow up to see if you’ve had an opportunity to look over my earlier response. Please let me know if you have any further questions.

Hello @Sai Prabhu Naveen Parimi

Thanks for the recommendations. I checked my current Azure Container Apps, but I don’t see any option to Disable Public Network Access. I suspect this might be because the Container Apps are deployed in an environment that’s configured as public. I also don’t see the settings for private endpoints or VNet-only ingress in the portal for these resources.

Is this limitation due to the environment type used when the Container Apps were created? If so, would changing it require creating a new environment with VNet integration?

Hi @Abdelrhman Goma

You’re correct — this behavior is due to the environment type. Once an Azure Container Apps environment is created as public or internal, the type can’t be changed later (Microsoft documentation). That’s why you’re not seeing options for private endpoints or VNet-only ingress in the portal.

The only way to achieve VPN-only access is to deploy your apps into a new internal (VNet-integrated) environment and migrate them over.

Hi @Sai Prabhu Naveen Parimi

Is there any way to do it easily something Microsoft provide or i need to recreate everything from scratch