Single Subnet vs Separate Subnets for Private Endpoints

Question

Hi

We're building various services in Azure (Logic App, Function App, Storage Account, Event Grid, Event Bus, Service Bus, and APIM). These services will be enabled with a Private Endpoint (PE) and all the public endpoint connectivity will be disabled. Understand that we can create private endpoints for various services in a single Azure subnet. However, unsure if placing the PEs for all services should be placed in a single subnet or separate them out, say as per the N-tier architecture? Could not find any guidance on what's a good and secure practice around this.

Placing them all in a single subnet is much cleaner, but on the flip side, if there are separate NSG and Service Endpoint requirements, we end up enabling all on the same subnet. Is this really a valid reason to go with multiple subnet structure?

Looking forward to hearing the expert thoughts.

Thanks

Answer 1

@Taranjeet Malik ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

To answer your question in short,

• This completely depends on your architecture.

Summary,

• Per your verbatim, you said you will be using multiple PaaS Services
• But you did not mention what the users (sources) would be
• If they are going to access all of these services from a VM (or P2S or S2S) which are all part of the same private network - then it would make sense to put them in a single subnet
• However, if certain sources access only certain set of PaaS services and a different set of sources access a different set of PaaS Services - then it is better to group them based on this.
  • This would give you the ability to use UDRs or NSGs on these PE subnets in the future, if required.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.