Azure data factory calling restapi hosted on app service

Pankaj Joshi 371

I am calling restapi POST method hosted on app service from azure data factory(web activity) using VNet integration runtime, I am using authentication type as NONE. but it is giving error as Error "403 Forbidden 'the web app you have attempted to reach has block your access". However linked service connection is successful for restapi url. App service hosting Rest api is integrated with vnet (private end point enabled and disabled public network) and all required nsg are there. I also tried to add managed private end point from adf to app service but it does not have any option for app service. However I am able to call same restapi successfully from postman. Please advise what could be the issue, is it possible to call restapi hosted on app service from adf?

Chandra Boorla 8,795 Reputation points Microsoft Vendor

2025-02-11T01:15:09.13+00:00

Hi @Pankaj Joshi

Just checking in to see if the below answer provided by @ Vinodh247 helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

Chandra Boorla 8,795 Reputation points Microsoft Vendor

2025-02-18T15:41:36.7566667+00:00

@Pankaj Joshi

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Issue:

Azure data factory calling restapi hosted on app service

Solution:

"It's not possible to achieve this with Managed VNet runtime. Another option is to use SHIR.

We are able to call the REST API successfully with SHIR."

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Please sign in to rate this answer.
Chandra Boorla 8,795 Reputation points Microsoft Vendor

2025-02-19T12:38:16.11+00:00

@Pankaj Joshi

Following up to see if the above suggestion was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Vinodh247 28,211 Reputation points MVP

2025-02-10T01:32:10.44+00:00
Hi ,

Thanks for reaching out to Microsoft Q&A.

Yes, it is possible to call a REST API hosted on an App Service from ADF, but in your case, the issue arises because the App Service is integrated with a private endpoint, and public access is disabled. This results in a "403 Forbidden" error when ADF attempts to call the REST API because of network restrictions.

Use Managed VNet in ADF Integration Runtime: Ensure that your ADF is using a managed VNet-enabled integration runtime.

Configure VNet Peering: Peer the ADF managed VNet with the VNet where the App Service private endpoint is hosted.

Private DNS Setup: Add a private DNS entry for the App Service ( myapp.privatelink.azurewebsites.net) in the DNS linked to the ADF managed VNet.

Validate NSG Rules: Add NSG rules to allow traffic from ADF's managed VNet to the App Service's private endpoint subnet.

Test Web Activity: Once the above configurations are complete, retry the Web activity in ADF.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.
Please sign in to rate this answer.
Pankaj Joshi 371 Reputation points

2025-02-10T04:55:54.5366667+00:00

For point 4 , How to find IP of ADF managed VNet?

Vinodh247 28,211 Reputation points MVP

2025-02-10T06:48:12.4266667+00:00

Go to the Azure Portal:

Navigate to your Azure Data Factory resource.

Check Integration Runtime Settings:

In the Data Factory settings, go to Manage > Integration Runtimes.

Locate your Azure IR (with Managed VNet enabled).

Click on the integration runtime to view its details.

Check Managed Private Range:

In the Integration Runtime details, look for the Managed Private Range under the "Virtual Network Configuration" section.

This range will be in CIDR format, e.g., 10.x.x.x/16.

Note: This range is automatically assigned by Azure when the managed VNet is created.

To confirm the IP ranges or verify connectivity:

NSG Logs: If there are NSGs applied to the App Service's private endpoint subnet, you can check the NSG flow logs to see which IP ranges are attempting to connect. Requests from ADF's managed VNet should appear there.

Key Points About ADF Managed VNet:

The Managed Private Range defines the IP address range used by the managed VNet for outbound traffic.

This range must be allowed in your NSG rules and any other network restrictions (ex: firewall, service endpoints).

Chandra Boorla 8,795 Reputation points Microsoft Vendor

2025-02-12T01:29:30.1566667+00:00

@Pankaj Joshi

Just checking in to see if the above answer provided by @ Vinodh247 helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Pankaj Joshi 371 Reputation points

2025-02-14T11:53:40.0633333+00:00

I am not able to see The Managed Private Range under the "Virtual Network Configuration" section. Please see screenshot. Please advise.

1739533648625_resize.jpg

Also web app (where rest api is hosted) in app service has virtual network integration displayed as "test01-t-vnet/appservice01-subnet" in networking section of app services overview in portal

So I checked in NSG log of appservice01-subnet and I dont see any incoming request from ADF.

Vinodh247 28,211 Reputation points MVP

2025-02-15T11:49:27.2733333+00:00

VNet Integration in the App Service alone does not let ADF call it privately; it’s only for outbound from App Service to vNet.

You need an inbound private endpoint for ADF, typically by either:

creating an App Service Private Endpoint (and hooking up adf's Managed VNet to it),

using API Management with a private endpoint, or

using a Self-Hosted Integration Runtime on a VM in the same subnet.

Once you set up a proper inbound path, you’ll stop getting 403 and your calls will show up in NSG logs.

Pankaj Joshi 371 Reputation points

2025-02-15T17:02:31.1366667+00:00

Probably I can use option - "API Management with a private endpoint" since we already have same rest api available via api management also.

I am able to call rest api via api management url successfully through POSTMAN tool and getting success response.

However when I tried calling restapi (api management url) using ADF , its giving error as "could not able to resolve hostname"

it seems ADF not able to resolve restapi url.

Please advise If I am missing something or any steps I need to perform at ADF side or something need to be whitelisted?

Vinodh247 28,211 Reputation points MVP

2025-02-15T17:20:06.9733333+00:00

Enable Inbound Private Endpoint on APIM in the same subnet/VNet.

Create a Managed Private Endpoint from ADF to APIM.

Verify DNS so that ADF resolves your APIM domain to its private IP.

In your pipeline, use an HTTP or REST Linked Service that references your APIM URL and uses the Managed VNet IR.

try and see what are you getting in this

Pankaj Joshi 371 Reputation points

2025-02-16T09:49:51.3966667+00:00

I am struggling to find below two option in ADF as I believe this is required to hook up adf's Managed VNet either to app service or APIM private end point. Please help in finding below options :

Not able to locate - The Managed Private Range under the "Virtual Network Configuration" section (see screenshot) This is required to know IP address range used by the managed VNet for outbound traffic.

Not able to find option for creating NEW MANAGED PRIVATE END POINT from ADF to either app service or APIM ( see screenshot)

Pankaj Joshi 371 Reputation points

2025-02-17T07:45:40.62+00:00

is it possible to create NEW MANAGED PRIVATE END POINT from ADF to either app service or APIM.

it showing option for storage, keyvault, database but not for app service

Chandra Boorla 8,795 Reputation points Microsoft Vendor

2025-02-17T12:13:32.8066667+00:00

@Pankaj Joshi

Currently, Azure Data Factory does not support creating a Managed Private Endpoint (MPE) for App Service or API Management (APIM). Managed Private Endpoints in ADF are available only for specific Azure services like Storage, SQL Database, Cosmos DB, and Key Vault.

Alternative Solution:

Use a Private Endpoint for App Service/APIM + Private DNS

Create a Private Endpoint for your App Service or APIM inside an Azure Virtual Network (VNet).

Configure a Private DNS Zone (e.g., privatelink.azurewebsites.net for App Service).

Link ADF’s Managed VNet to this Private DNS Zone to allow name resolution.

For more detail, please refer: Using private endpoints for App Service apps

I hope this information helps.

Pankaj Joshi 371 Reputation points

2025-02-17T13:29:06.1066667+00:00

Thanks for you reply. Above two points are clear but third point is not clear

how do we Link ADF’s Managed VNet to this Private DNS Zone ?

Pankaj Joshi 371 Reputation points

2025-02-18T13:23:19.6033333+00:00

its not possible to achieve this with Managed VNet runtime.

Other option is to use SHIR, we are able to call rest api successfully with SHIR

Chandra Boorla 8,795 Reputation points Microsoft Vendor

2025-02-18T15:42:10.05+00:00

@Pankaj Joshi

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure data factory calling restapi hosted on app service

1 additional answer

Your answer