"Enable Azure Resource Manager Private Network Access" for Azure App Configuration not working

Hi Low Soon Chew,

you have done everything correctly for securing the data plane, but you have locked yourself out of the azure portal's configuration explorer.

the 'configuration explorer' in the azure portal is a web interface that runs on your local machine. when you set up the private endpoint and disable public access, you are blocking all connections to your app configuration store that do not come from within your virtual network. your local machine is not on that virtual network, so the portal cannot connect to the store to display the data.

the setting 'enable azure resource manager private network access' only affects management operations via the arm api, not the data plane access through the portal.

to access the configuration explorer from the portal, you have a couple of options.

the most straightforward way is to use an azure virtual machine that is inside the same virtual network as your private endpoint. remote desktop into that vm, open a web browser there, and then go to the azure portal. from within that vm, you will be able to access the configuration explorer because the traffic is originating from inside the vnet.

another option is to set up an azure vpn gateway point to site vpn. this would allow you to connect your local machine to the azure virtual network. once connected, your local machine would have a route to the private endpoint and you could use the configuration explorer from the portal on your own pc.

this is a common pattern for any azure service that uses private endpoints. the portal is an external tool, so it gets blocked when public access is turned off. you always need a machine inside the network to manage it, or you need to vpn in.

you have not broken anything. to use the configuration explorer, you need to access it from a virtual machine that is inside your azure virtual network.

regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/

Hi Low Soon Chew,

Thank you for posting your question in the Microsoft Q&A forum

The issue you're facing accessing Azure App Configuration's Configuration Explorer after enabling Private Endpoint and Azure Resource Manager Private Network Access is a common challenge due to the portal's reliance on public access paths.

1.      Add Azure Portal IPs to Private Endpoint Allow List:

Configure your Private Endpoint's Network Security Groups (NSGs) or firewall rules to allow Azure Portal traffic IPs.

Azure portal uses dynamic IPs and may require opening network access to a broader Azure management IP range or service tags like AzurePortal.

2.      Use Azure Bastion or Jumpbox in VNet:

Access the Configuration Explorer or run management tasks from inside the same virtual network via a jumpbox or Azure Bastion Host.

Use tools like Azure CLI or PowerShell from a VM in the VNet to manage App Configuration.

Reference

How to set up private access to an Azure App Configuration store | Microsoft Learn

app configuration with private endpoint not working · Issue #24289 · Azure/azure-cli

I hope the provided answer is helpful,

Please "Up Vote" if the information helped you. This will help us and others in the community as well.

Thank you.