How to setup Entra custom authentication extensions private network access

Hi Nicholas,

I have not come across a documented service tag for Entra extension traffic.

Without knowing more about your network setup, it may be difficult to provide the answer you are seeking but some points to consider,

1. When using Entra Custom authentication extension service how/where are you running your extension logic?
   1. One option could be using an Azure Function App with a private endpoint configured
   2. https://learn.microsoft.com/en-us/azure/azure-functions/functions-create-vnet
2. update DNS to resolve private endpoint internally
3. Consider networking,
4. VNET peering between subscriptions/Tenants
   1. https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions?tabs=create-peering-portal
   2. Route Traffic to your endpoint
5. If it's a hybrid deployment you should still be able to route traffic to the private end point over your existing network
   1. Consider Routing/firewall changes required for the desired connectivity.

The following article provides information on Custom Claims and security guidelines for protecting the Function App

https://learn.microsoft.com/en-us/entra/identity-platform/custom-extension-tokenissuancestart-configuration?tabs=azure-portal%2Cworkforce-tenant

If you are using a public end point for your App Service, you can consider deploying it behind an application gateway.

https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app?tabs=customdomain%2Cazure-portal

Hope this helps