Is API Management Standard v2 with VNet integration able to use VPN Connections

Cedric Ahlers 55

We are currently planning the usage of Azure API Management. We have the following requirement:

Privately connect form APIM to Backend API Services
Backend API Services are located in the same VNet, peered VNets and external Datacenters connected via a VPN provided by the Azure Hub (Azure Hub & Spoke Topology)

Currently we are struggling if the new Standard v2 SKU with enabled VNet integarion (not Injection as the Premium SKUs) is capable to satisfy these requirements or not.

The Azure Pricing Page of API Management mentions extra for the Standard v2 SKU that it's only able to connect to API backends that are isolated in a single connected VNET.

User's image

But certain Blog posts are mentioning that VPN communication is possible - like this on

User's image

I'm confused. Is someone able to clearify this ?

Khadeer Ali 3,670 Reputation points Microsoft Vendor

2025-02-21T12:22:30.5033333+00:00
@Cedric Ahlers ,

Thanks for reaching out. The Standard v2 tier with VNet integration is designed to connect to resources directly within the VNet it's linked to. It can access services within the same VNet, similar to accessing resources on a local network.

Comparison with Premium and Developer Tiers

The key difference between the Standard v2 tier and the Premium/Developer tiers lies in how the API Management instance is deployed:

Standard v2: Integrated into the VNet, allowing it to reach into the VNet but not fully reside within it.

Premium/Developer: Injected into the VNet, meaning they actually live inside the VNet and follow all the VNet's routing rules.

Routing Differences and Implications:

Because the Premium and Developer instances are truly inside the VNet, they adhere to all the VNet's routing rules, including those for VPNs and peering. This allows them to seamlessly connect to backend services in peered VNets or even on-premises via a VPN.

On the other hand, the Standard v2 tier does not automatically traverse VPN connections or peered VNets. To achieve this, you would need additional workarounds such as an Application Gateway or Azure Relay, which can add complexity to your setup.

Recommendation:

Based on your requirements to connect to backend API services located in the same VNet, peered VNets, and external datacenters via a VPN, the Premium tier is usually the better choice. While it may have a higher upfront cost, it simplifies network configurations and reduces troubleshooting efforts in the long run. References: https://learn.microsoft.com/en-us/azure/api-management/virtual-network-concepts
Cedric Ahlers 55 Reputation points

2025-02-21T15:17:02.11+00:00
Hi @Khadeer Ali thanks for pointing out the difference between *VNet integration *and VNet injection!

I understand the Standard v2 SKU isn't actually running inside the VNet and is only using IPs out of the delegated Subnet to communicate to private Backends. However, what does the APIM route through this Subnet ? Whole RFC-1918 ? The routes know to the Subnet (+UDR) or just the address spaces of the VNet ? Do you know that ?

I gave it a try by deploying the following:

One VNet hosting an Standard v2 APIM

with VNet injection configured on the APIM

One peered VNet hosting a Web App

with a private Endpoint in the Web App VNet

with public access set to Deny

with VNet injection configured for the Web App

Exposed the API of the Web APP

=> And it worked! The APIM was able to talk to the Web App in the peered VNet. Unfortunately I don't have firewall available to test it with S2S VPN too.

Share via

Is API Management Standard v2 with VNet integration able to use VPN Connections

Your answer