So this is my,
very simple,
"to-do" list of web applications that I
have just deployed, in the interest of
time, on Azure App Service that if
I go ahead and this is what the application
does, it basically uses a SQL server
behind the scenes where I can create new
tasks. These tasks are persistent in
Azure SQL behind the scenes.
Now again,
to start from a security perspective,
the first step that you should do for
your web application is to go through the
whole Security Center experience for
your web application.
And if there are any recommendations which
are for your web application,
that will show up in the security center
over here,
if there any security alerts or if
there any security recommendations like
you should be using, example, SSL or
you should be using Manage Identity.
Those kind of alerts and recommendations show
up here on Security Center.
Now, starting up with the whole networking
and VNet integration piece.
Let's look at the whole setup around VNet
integration.
So you basically navigate to the Networking
play to configure VNet integration.
You click on configure the VNet integration
as you can see that my web application is
already a part of
VNet named pv3VNet
and it is part of a VNet named
appsubnet. Now,
once I go inside the appsubnet,
What I see here is that I am going to
this web application.
will securely connect to Azure SQL
using service end points.
And that's the reason that I am basically
delegating the sub-NET to my web application
and the service that this insecurity connect
to is Microsoft SQL.
Well, if I was to see the similar VNet
settings from an Azure SQL perspective,
basically,
please understand that the networking settings
for Azure SQL are applicable for
the server and not for database.
So this is the database,
by the way,
that my application is using todedb.
What I am going to do here is I'm
going to navigate to the underlying SQL
Server and over here when I go ahead and
click on firewall and virtual networks -
if you see my SQL Server is
also pretty much part of the same virtual
network, because, if you remember,
as I mentioned a few minutes back,
both the database and the web application, to
make use of the visual VNet
has to be in the same Azure region.
And if you say I'm explicitly saying that
do not allow access to any Azure
services and resources because I want
a secure connectivity over my VNet.
And if you see I can just go ahead and
create a new task - and
it just works. Now just to, again, show
you how things work,
let me go over there and disconnect my
web application from this virtual network.
And if I now refresh the page,
the web application doesn't work because my web
application is unable to connect to
the underlying database.
So, let me go ahead and add the virtual network again.
And as you can see,
we are back to the similar configuration.
And if I now go back and refresh my
web applications,
it just works