AZURE application insights and log ingestion and querying from public networks

MrFlinstone 641

We have got Azure app insights configured within our environments where all azure resources are behind a private endpoint with VNET integration. I am evaluating the consequences of turning off the following options within Azure application insights and setting the option to NO

Accept data ingestion from public networks not connected through a Private Link Scope

Accept queries from public networks not connected through a Private Link Scope

Any thoughts on what the impact would be or the consequences of turning off public access on the above.

Thanks in advance.

1 answer

Ashok Gandhi Kotnana 1,580 Reputation points Microsoft Vendor

2024-12-16T10:48:21.62+00:00
Hi @MrFlinstone ,

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

When you disable public access for ingestion, no machine can send data to this component except those that are configured to send traffic through Azure Monitor Private Link.

Refer Document: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security#configure-access-to-your-resources
2. When you disable public access for queries, no machine can access data in this component except those that are configured through Azure Monitor Private Link

Refer Document: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security#configure-access-to-your-resources

Same Impact for both if we keep that to disable

Please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.
MrFlinstone 641 Reputation points

2024-12-16T12:10:12.92+00:00

Thanks for the information, I do have some comments around the setup. Where one has several app insights and log analytics workspaces on a hub/spoke configuration. Once the AMPLs is created, integrate it ont he hub network, create a private endpoint and then link every application insights or log analytics workspaces to the AMPLS, at this point public data ingestion and querying from public networks can be disabled ? I have a few questions.

How many IP addresses does one need to account for ?

Will it just be a single DNS configuration for the private endpoint connected to the AMPLS that one needs to account for ?

Does every log analytics workspace require an IP address allocation ?

What is the total number of application insights/log analytics workspaces that can be linked to a single AMPLS ?

Are there any design considerations from an availability perspective when having a single AMPLS ?

Ashok Gandhi Kotnana 1,580 Reputation points Microsoft Vendor

2024-12-16T13:35:57.9166667+00:00

Hi @MrFlinstone ,

Thank you so much for the response back, Please find the below in answers

How many IP addresses does one need to account for?
A) For each resource if we enable the private end One Ip address will get assigned from the subnet you allocate. So, the number of IP addresses will depend on the number of private endpoints you create

Will it just be a single DNS configuration for the private endpoint connected to

the AMPLS that one needs to account for?

A) a. If You Select "Yes" (Integrate with Private DNS Zone):

Azure will automatically create and manage the necessary DNS records in the private DNS zone associated with the service you're connecting to. This simplifies DNS management significantly.

b. If You Select "No" (Do Not Integrate with Private DNS Zone):

You take full responsibility for managing DNS resolution manually.

Refer DNS Tab: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-configure

Does every log analytics workspace require an IP address allocation?
A) Each Log Analytics workspace does not require a separate IP address allocation. Instead, they will use the private IPs from the subnet allocated to the private endpoint
Refer: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-configure

4.What is the total number of application insights/log analytics workspaces that can be linked to a single AMPLS?
A) An AMPLS object can connect to up to 300 Log Analytics workspaces and up to 1,000 Application Insights components.

Refer: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-design

5.Are there any design considerations from an availability perspective when having a single AMPLS?
A) Availability Considerations: When designing for availability, it's important to ensure that your AMPLS is highly available and resilient to failures. This can be achieved by:

Using multiple private endpoints in different subnets or availability zones.

Implementing failover mechanisms to switch to a backup endpoint in case of a failure.

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

Ashok Gandhi Kotnana 1,580 Reputation points Microsoft Vendor

2024-12-17T08:20:36.8666667+00:00

Hi @MrFlinstone ,
Just want to check if the above comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

MrFlinstone 641 Reputation points

2024-12-17T16:59:04.4066667+00:00

Thanks very much for the helpful information. Wanted to understand a bit more.

As it stands, what exactly is routed through a public network if one is using log analytics workspaces and app insights? What exactly is publicly accessible ?

What would be the impact of the network changes with existing log analytics workspaces and app insights ?

How can we test that functionality still works after the implementation to ensure no unintended consequences ?

From the above, it appears that if the private endpoint is situated on the hub, only 1 IP address would be required which is that of the private endpoint ?

Having a log analytics workspace and app insights at a different region from a DR perspective and what it means from AMPLS perspective.

Ashok Gandhi Kotnana 1,580 Reputation points Microsoft Vendor

2024-12-19T07:00:43.5+00:00

Hi @MrFlinstone ,
Thank you so much for the response back, please find the below inline answers

As it stands, what exactly is routed through a public network if one is using log analytics workspaces and app insights? What exactly is publicly accessible?
A) Yes, Azure Log Analytics workspace data export traffic travels over the Azure backbone network. This traffic doesn't leave the Azure network
Refer: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-data-export?tabs=portal

What would be the impact of the network changes with existing log analytics workspaces and app insights?
A). No network changes required just enable the feature form private to public

How can we test that functionality still works after the implementation to ensure no unintended consequences?
A) Create a test Log analysis workspace and application insights and and couple of resource to test vm ,storage etc

From the above, it appears that if the private endpoint is situated on the hub, only 1 IP address would be required which is that of the private endpoint?
A) 1 IP for each PAAS service when you enable a private endpoint
example: Storage 1 IP, App service 1 IP

Having a log analytics workspace and app insights at a different region from a DR perspective and what it means from AMPLS perspective.
A) Refer: https://learn.microsoft.com/en-us/azure/azure-monitor/app/create-workspace-resource?tabs=bicep

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

Ashok Gandhi Kotnana 1,580 Reputation points Microsoft Vendor

2024-12-20T06:40:31.63+00:00

Hi @MrFlinstone ,
Just want to check if the above answer worked for you or else please let us know if any help, we are always here to help whenever you need us.

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

Ashok Gandhi Kotnana 1,580 Reputation points Microsoft Vendor

2024-12-23T06:04:07.51+00:00

Hi @MrFlinstone ,
Just wanted to re check if the above answer worked for you or else please let us know if any help, we are always here to help whenever you need us.

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

AZURE application insights and log ingestion and querying from public networks

1 answer

Your answer