Is API Management Standard v2 with VNet integration able to use VPN Connections

Cedric Ahlers 75

We are currently planning the usage of Azure API Management. We have the following requirement:

Privately connect form APIM to Backend API Services
Backend API Services are located in the same VNet, peered VNets and external Datacenters connected via a VPN provided by the Azure Hub (Azure Hub & Spoke Topology)

Currently we are struggling if the new Standard v2 SKU with enabled VNet integarion (not Injection as the Premium SKUs) is capable to satisfy these requirements or not.

The Azure Pricing Page of API Management mentions extra for the Standard v2 SKU that it's only able to connect to API backends that are isolated in a single connected VNET.

User's image

But certain Blog posts are mentioning that VPN communication is possible - like this on

User's image

I'm confused. Is someone able to clearify this ?

Khadeer Ali 3,750 Reputation points Microsoft External Staff

2025-02-21T12:22:30.5033333+00:00
@Cedric Ahlers ,

Thanks for reaching out. The Standard v2 tier with VNet integration is designed to connect to resources directly within the VNet it's linked to. It can access services within the same VNet, similar to accessing resources on a local network.

Comparison with Premium and Developer Tiers

The key difference between the Standard v2 tier and the Premium/Developer tiers lies in how the API Management instance is deployed:

Standard v2: Integrated into the VNet, allowing it to reach into the VNet but not fully reside within it.

Premium/Developer: Injected into the VNet, meaning they actually live inside the VNet and follow all the VNet's routing rules.

Routing Differences and Implications:

Because the Premium and Developer instances are truly inside the VNet, they adhere to all the VNet's routing rules, including those for VPNs and peering. This allows them to seamlessly connect to backend services in peered VNets or even on-premises via a VPN.

On the other hand, the Standard v2 tier does not automatically traverse VPN connections or peered VNets. To achieve this, you would need additional workarounds such as an Application Gateway or Azure Relay, which can add complexity to your setup.

Recommendation:

Based on your requirements to connect to backend API services located in the same VNet, peered VNets, and external datacenters via a VPN, the Premium tier is usually the better choice. While it may have a higher upfront cost, it simplifies network configurations and reduces troubleshooting efforts in the long run. References: https://learn.microsoft.com/en-us/azure/api-management/virtual-network-concepts
Cedric Ahlers 75 Reputation points

2025-02-21T15:17:02.11+00:00
Hi @Khadeer Ali thanks for pointing out the difference between *VNet integration *and VNet injection!

I understand the Standard v2 SKU isn't actually running inside the VNet and is only using IPs out of the delegated Subnet to communicate to private Backends. However, what does the APIM route through this Subnet ? Whole RFC-1918 ? The routes know to the Subnet (+UDR) or just the address spaces of the VNet ? Do you know that ?

I gave it a try by deploying the following:

One VNet hosting an Standard v2 APIM

with VNet injection configured on the APIM

One peered VNet hosting a Web App

with a private Endpoint in the Web App VNet

with public access set to Deny

with VNet injection configured for the Web App

Exposed the API of the Web APP

=> And it worked! The APIM was able to talk to the Web App in the peered VNet. Unfortunately I don't have firewall available to test it with S2S VPN too.
VenkateshDodda-MSFT 23,971 Reputation points Microsoft Employee

2025-02-24T12:19:27.3433333+00:00

@Cedric Ahlers , Thanks for your response I am checking with internal team on this and will update here once I hear back from them.
Cedric Ahlers 75 Reputation points

2025-02-24T12:59:11.65+00:00

Thank you for your effort! Appreciate it @VenkateshDodda-MSFT
VenkateshDodda-MSFT 23,971 Reputation points Microsoft Employee

2025-02-25T15:59:53.24+00:00

@Cedric Ahlers Thanks for your patience on this.

I have checked with internal team on this, and they confirmed that all the traffic will be sent through your virtual network using a private Ip address from the delegated subnet of the Vnet.
VenkateshDodda-MSFT 23,971 Reputation points Microsoft Employee

2025-02-26T04:47:57.13+00:00

@Cedric Ahlers Following up to see if you have a chance to check the previous response and helped. Do let me know if you have any further questions on this.

Accepted answer

VenkateshDodda-MSFT 23,971 Reputation points Microsoft Employee

2025-02-27T11:58:33.4066667+00:00

@Cedric Ahlers Thanks for your patience on this I am summarizing our conversation and posting the same as answer for the benefit of other community members.

Based on the information shared, vnet integration with Standard V2 apim instance will workout for your requirement.

As called out in the documentation here, using Vnet Integration you can restrict Outbound request traffic can reach APIs hosted in a delegated subnet of a single connected virtual network.

Regarding this question:

what does the APIM route through this Subnet ? Whole RFC-1918 ? The routes know to the Subnet (+UDR) or just the address spaces of the VNet ? Do you know that ?

I have checked with internal team on this, and they confirmed that all the traffic will be sent through your virtual network using a private Ip address from the delegated subnet of the Vnet.

Hope this help, let me know if you have any further questions on this.

Please accept as Yes if the answer is helpful so that it can help others in the community.
Please sign in to rate this answer.

1 person found this answer helpful.
Cedric Ahlers 75 Reputation points

2025-02-28T13:00:44.4666667+00:00

apologize my late response!

It took me some time to test it out. I've connected two VNets using S2S VPN and can confirm that a app service with public access disabled and a private endpoint is still accessible via the APIM using Standard v2 and VNet integration.

I appreciate your effort! Thanks a lot!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Is API Management Standard v2 with VNet integration able to use VPN Connections

0 additional answers

Your answer