Configure user defined routes on Azure MySQL / PostgreSQL Flexible server deployed with private access

Question

Configure user defined routes on Azure MySQL / PostgreSQL Flexible server deployed with private access

Cedric Ahlers 115

Hi,

we have a Azure MySQL Flexible Server and Azure PostgreSQL Flexible Server deployed using the private access mode - so the Database Servers are VNet injected into a delegated subnet.

Our Network is using a star topology with a central Azure Hub Network running an Azure Firewall and different Spoke Networks peered to this Hub. To establish transitive routing between the Spoke Networks via the Hub Network the Spokes have user-defined route tables configured to route 0.0.0.0/0 via the Azure Firewall.

Previously the Spokes running the Flexible Servers were not connected to this Hub, but know have to be connected. Unfortunately it's poorly documented which routes have to be present in the route table so the Flexible Servers continue to function normally.

The Azure Postgres Flexible Server Documentation has a side note that VnetLocal and AzureActiveDirectory routes should be present, but I couldn't find any documentation about MySQL Flexible Server or reliable documentation for PostgreSQL Flexible Server that mentions the required routes or if user-defined route tables are supported at all for the private access deployment.

We would like to redirect the default route 0.0.0.0/0 to the Azure Firewall and only route specific service tags directly to the next hop Internet.

Does anyone know wich service tags have to be routed directly to the Internet ?

I would really appreciate if anybody, who possible already set this up, can help me with that.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Anonymous

Hi @Cedric Ahlers
It looks like you're trying to configure user-defined routes for your Azure MySQL and PostgreSQL Flexible Servers in a private access deployment. Understandably, getting this routing right can be tricky, especially with your Hub and Spoke network setup.

Routing Requirements: When using private access for Azure Database services, here are a few points to consider based on the documentation:

User-Defined Routes: Azure Database for MySQL and PostgreSQL Flexible Servers support user-defined routes, but specific configuration depends on your setup. You mentioned needing reliable documentation; while it's true that the official docs don't extensively cover every detail, a few essential routes are often necessary:

Ensure the VNetLocal and AzureActiveDirectory service tags are present in your route tables.

Routes must also allow traffic to and from your Flexible Servers and any related resources.

Service Tags to Route:

- For your setup, you should typically allow routes for the service tags related to Azure Database services. Relevant service tags generally include:

      - `Sql` (for Azure SQL services)

            - `AzureDatabase` (which may encompass MySQL and PostgreSQL)

                  - Additionally, the tags you specifically choose to route directly to the Internet will depend on your use case (e.g., if you're using Azure Blob Storage or other endpoints).

                  **Adjust Routing**: Following your star topology, you’d route `0.0.0.0/0` through the Azure Firewall and selectively route the necessary service tags to the Internet, as per your requirement.

                  **Documentation**: For further reference, I’ve included some links below to help you along the way:

Relevant Documentation:

Cedric Ahlers 115 Reputation points

2026-01-07T18:43:14.73+00:00

Hi @Vrishabhanath Patil thanks for the prompt response! The points your mentioning make sense and are matching my thoughts. Unfortunately these Systems are missions critical, therefore I would really appreciate reliable sources or knowledge of someone, who already had configured such or a similar setup.
I'm a bit confused by the poor documentation, usually Microsoft mentions the routing setup very clearly for VNet injected deployments.
Anonymous

2026-01-08T17:06:00.24+00:00

Hi @Cedric Ahlers

Thank you for your thoughtful note—it’s very much appreciated. I completely understand your concern, especially given the mission‑critical nature of these systems. Your expectation for clear, authoritative guidance is absolutely reasonable.

While the current documentation around routing for VNet‑injected deployments can feel limited, the points shared earlier remain aligned with known best practices and the behavior we consistently observe in similar environments. That said, I fully agree that validated references and prior implementation experience provide far greater confidence.

To ensure you have the most reliable path forward, I am actively checking for internal precedents and validated configurations that mirror your scenario. As soon as I have those verified details, I will share them with you so you can move ahead without any ambiguity.

In the meantime, please rest assured that the direction provided so far is in line with how such setups typically behave, and there is no deviation from expected Microsoft‑supported patterns.

Thank you again for raising this so clearly—your diligence is instrumental in getting this right.
Cedric Ahlers 115 Reputation points

2026-01-09T11:19:26.24+00:00

Hi @Vrishabhanath Patil

Thank you again for your response! I’m so glad you understand my concerns so far. I really appreciate any help we can give on forums like this and was worried my response could be got wrong.
Big appreciation that you are even continuing to fully resolve my concerns and actively checking internally! Let me now if I can help you out with any detail.
Anonymous

2026-01-09T19:44:52.2566667+00:00

Hi @Cedric Ahlers

If this solution helped resolve your issue, please consider clicking ‘Accept Answer’ or giving it an upvote to help others find it easily.
Cedric Ahlers 115 Reputation points

2026-04-10T10:03:54.5466667+00:00

In case anybody comes across this: Routing the Virtual Network space as Virtual Network and AzureActiveDirectory to Internet worked out for us to route 0.0.0.0 to an NVA for PostgeSQL and MySQL Flexible Server deployed with private Access within a VNet.
To be honest the Virtual Network Route is probably not even needed, this the default routing already apply this.

Share via

Configure user defined routes on Azure MySQL / PostgreSQL Flexible server deployed with private access

Relevant Documentation:

0 additional answers

Your answer