How to disable public access to ADF portal

Question

Enabling private endpoints, according to the the documentation, does not disable access to the public ADF portal.
What is a best practice for preventing access to the public portal for an ADF instance?
Thanks.

Answer 1

Hello @Bob Nonnenkamp ,

Welcome to the Microsoft Q&A platform.

Disabling public network access is applicable only to the self-hosted integration runtime, not to Azure Integration Runtime and SQL Server Integration Services (SSIS) Integration Runtime.

Note: You can still access the Azure Data Factory portal through a public network after you disable public network access.

If you would like to disable Public Network access to ADF, then you will have to create a Private Endpoint. A private endpoint is a private IP address within a specific virtual network and subnet. To protect your Azure resources from attacks in public network or let them securely communicate with each other, you can set up an Azure Virtual Network as a logical representation of your network in the cloud. You can also connect an on-premises network to your virtual network by setting up IPSec VPN (site-to-site) or ExpressRoute (private peering). The Self-hosted Integration Runtime can be installed on an on- premise machine or virtual machine in Virtual Network to run copy activities between a cloud data store and a data store in a private network or dispatch transform activities against compute resources in an on-premises network or an Azure virtual network.

With the support of Azure Private Link for Azure Data Factory, you can create a Private Endpoint (PE) in your virtual network and enable the private connection to specific Azure Data Factory.

As shown in the above image, the benefits of using private endpoint is that you can do authoring and monitoring of Azure Data Factory in your virtual network, even you block all outbound communications.

The command communications between Self-hosted Integration Runtime and Azure Data Factory service can be performed securely in a private network environment. The traffic between Self-hosted Integration Runtime and Azure Data Factory service goes through Private Link.

Helpful resources for reference:

Security considerations for data movement in Azure Data Factory
Azure Private Link for Azure Data Factory
What is Azure Private Link?

Hope this helps. Do let us know if you any further queries.

------------

• Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
• Want a reminder to come back and check responses? Here is how to subscribe to a notification.