Integrate an Azure API Management instance with a private virtual network for outbound connections

APPLIES TO: Standard v2 | Premium v2

This article guides you through the process of configuring virtual network integration for your Standard v2 or Premium v2 (preview) Azure API Management instance. With virtual network integration, your instance can make outbound requests to APIs that are isolated in a single connected virtual network or any peered virtual network, as long as network connectivity is properly configured.

When an API Management instance is integrated with a virtual network for outbound requests, the gateway and developer portal endpoints remain publicly accessible. The API Management instance can reach both public and network-isolated backend services.

If you want to inject a Premium v2 (preview) API Management instance into a virtual network to isolate both inbound and outbound traffic, see Inject a Premium v2 instance into a virtual network.

Prerequisites

• An Azure API Management instance in the Standard v2 or Premium v2 pricing tier
• (Optional) For testing, a sample backend API hosted within a different subnet in the virtual network. For example, see Tutorial: Establish Azure Functions private site access.
• A virtual network with a subnet where your API Management backend APIs are hosted. See the following sections for requirements and recommendations for the virtual network and subnet.

Network location

• The virtual network must be in the same region and Azure subscription as the API Management instance.

Dedicated subnet

• The subnet used for virtual network integration can only be used by a single API Management instance. It can't be shared with another Azure resource.

Subnet size

• Minimum: /27 (32 addresses)
• Recommended: /24 (256 addresses) - to accommodate scaling of API Management instance

Network security group

A network security group must be associated with the subnet. Configure any network security group rules that you need for the gateway to access your API backends. Network security groups (NSG) can also be used to block outbound traffic to the internet and access only resources in your virtual network. To set up a network security group, see Create a network security group.

Subnet delegation

The subnet needs to be delegated to the Microsoft.Web/serverFarms service.

For more information about configuring subnet delegation, see Add or remove a subnet delegation.

Permissions

You must have at least the following role-based access control permissions on the subnet or at a higher level to configure virtual network integration:

Configure virtual network integration

This section guides you through the process to configure external virtual network integration for an existing Azure API Management instance. You can also configure virtual network integration when you create a new API Management instance.

1. In the Azure portal, navigate to your API Management instance.
2. In the left menu, under Deployment + Infrastructure, select Network > Edit.
3. On the Network configuration page, under Outbound features, select Enable virtual network integration.
4. Select the virtual network and the delegated subnet that you want to integrate.
5. Select Save. The virtual network is integrated.

(Optional) Test virtual network integration

If you have an API hosted in the virtual network, you can import it to your Management instance and test the virtual network integration. For basic steps, see Import and publish an API.

Related content

• Use a virtual network with Azure API Management