Private endpoints are optional. You choose them on the Networking step of the Marketplace wizard, with a new virtual network or an existing one in the same region.
What private endpoints change#
| Resource | With private endpoints |
|---|---|
| SQL database | Reached over a private endpoint. Public access is off. |
| Key Vault | Reached over a private endpoint. Public access is off. |
| App Service | Joins the network on its own subnet so that it can reach the database and the vault. |
| Storage account | Stays public. Cloud PCs download from it directly, from Microsoft’s network. Access is by identity only, with no keys. |
| Container registry | Stays public. Images are built on Azure’s shared build agents and pulled by Foundry’s hosted agents. Access is by identity only. |
Restricting the App Service#
By default, with private endpoints on, Eido Build’s own web address stays public, so that your people can reach it from anywhere and sign in with Entra.
Restrict App Service public access gives the App Service a private endpoint of its own and turns its public access off. Your people then need a way into the network, such as a VPN, to install and use Eido Build.
Using an existing network#
If you bring your own virtual network:
- it must be in the same region as the installation
- the subnet for the App Service must already be empty and delegated to
Microsoft.Web/serverFarms - the installer never changes a subnet it did not create
Private DNS zones#
The installer creates the private DNS zones it needs and links them to the network.
If your network already has those zones, which is common with a hub network, name the existing ones in the wizard instead. A second zone with the same name cannot be linked to the same network.
Updates still work#
Eido Build deploys its own updates through Azure Resource Manager, not through the App Service’s deployment site. That is what lets updating work when the App Service is private. See Updates.
Outbound access#
Private endpoints govern how traffic reaches your resources. Eido Build still needs to make outbound calls, to license.eido.io and to your repository host among others. If you filter outbound traffic, allow the addresses listed in Before you install.