How to override VNET

Question

How to override VNET

Thandisizwe Jack 0

Is this ok to override default routes for the vnet injected Azure API Management instance towards the Hub firewall? As per the Hub and Spoke Design. I am required to use APIM in Internal Mode (Vnet Injected) with an internal App Gateway in its front

Tejaswini Billakurthi 270 Reputation points Microsoft External Staff Moderator

2026-09-09T12:19:57.5133333+00:00
Hello @Thandisizwe Jack ,

Thank you for reaching out to Microsoft Q&A!

The guidance already shared in the thread is accurate. Service endpoints on the APIM subnet for Azure SQL (primary region), Azure Storage, Azure Event Hubs, and Azure Key Vault are the documented approach to keep dependency traffic on the Azure backbone rather than force tunneling it through the firewall. Overriding the default route toward a hub firewall is supported for an internal-mode APIM deployment, provided the documented APIM dependencies and routing requirements are configured correctly.

One additional step in the documentation that is easy to overlook, and is frequently the cause of force-tunneled deployment issues, is configuring a UDR for the ApiManagement service tag with a next hop type of Internet. Control-plane traffic reaches the management endpoint on port 3443 from the ApiManagement service tag IP ranges. When this traffic is force tunneled, return traffic may not follow the expected path, causing loss of connectivity to the management endpoint. Microsoft notes that allowing this return path to bypass the firewall is not considered a significant security risk because inbound access on port 3443 should already be restricted to the ApiManagement service tag.

A few points specific to your design:

Any remaining outbound dependency traffic routed through the hub firewall must be allowed, including metrics and health monitoring, Azure portal diagnostics, SMTP relay, developer portal CAPTCHA, and Azure KMS.

Since your deployment uses internal mode behind an internal Application Gateway, the per-client UDR requirement for gateway and developer portal data-plane traffic does not apply, as that guidance is specific to external-mode deployments.

After the routes are configured, you can review Network > Network status in the APIM instance to validate connectivity to required and optional dependencies and confirm that the firewall is not blocking necessary traffic.

Reference: Deploy your Azure API Management instance to a virtual network - Internal mode (Force tunnel traffic to on-premises firewall using ExpressRoute or network virtual appliance)

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.

2 answers

Your answer

Answer 1

Yes, but not as a blanket forced-tunnel without exceptions.

For an Azure API Management instance deployed in internal mode inside a VNet, sending all outbound traffic from the APIM subnet to an on-premises firewall or hub firewall by using a default route (0.0.0.0/0) can break APIM connectivity. This happens when outbound traffic is blocked or NATed in a way that no longer works with required Azure endpoints.

Supported guidance is:

If a default route from the APIM subnet points to the hub firewall or another network virtual appliance, enable service endpoints on the APIM subnet for these dependent services: Azure SQL Azure Storage Azure Event Hubs Azure Key Vault With those service endpoints enabled, traffic from APIM to those Azure services uses the Azure backbone and is not force tunneled. Any remaining APIM dependency traffic that is still force tunneled must be explicitly allowed through the firewall or virtual appliance. If that traffic is blocked, APIM might not function correctly. If the requirement is to force tunnel all traffic from the APIM subnet, the firewall or virtual appliance must allow the complete IP address range of each dependent service and that configuration must be kept current as Azure infrastructure changes. Be aware that force tunneling APIM traffic can introduce latency or unexpected timeouts. For a hub-and-spoke design with APIM internal mode behind an internal Application Gateway, overriding the APIM subnet default route toward the hub firewall is therefore acceptable only when the APIM service dependencies are handled correctly. The safer documented pattern is to use service endpoints for the supported dependencies and ensure the hub firewall allows the remaining required outbound traffic.

Tejaswini Billakurthi 270 Reputation points Microsoft External Staff Moderator

2026-09-10T10:48:07.2933333+00:00

Hello @Thandisizwe Jack ,

Yes, this approach is consistent with the documented guidance.

Overriding the default route from the APIM subnet to a hub firewall is a supported hub-and-spoke pattern, but it should not be implemented as a blanket forced-tunnel configuration without accounting for Azure API Management dependencies.

The key considerations are:

Ensure the required APIM dependencies remain reachable. Service endpoints for Azure Storage, Azure SQL, Azure Event Hubs, and Azure Key Vault are the recommended approach where applicable.

Configure the documented UDR exception for the ApiManagement service tag with a next hop type of Internet, so that return traffic to the management endpoint on port 3443 is not force tunneled.

Any remaining APIM dependency traffic that traverses the hub firewall must be explicitly allowed.

After deployment, review Network > Network status in the APIM instance to validate connectivity to required dependencies and confirm that routing and firewall policies are not blocking service operations.

For an internal-mode APIM deployment behind an internal Application Gateway, this architecture is supported as long as the documented routing and dependency requirements are implemented.

Reference: Deploy your Azure API Management instance to a virtual network - Internal mode

If this answered your question, please mark it as accepted so others with the same design question can find it.

Answer 2

Yes, but not as a blanket forced-tunnel without exceptions.

For an Azure API Management instance deployed in internal mode inside a VNet, sending all outbound traffic from the APIM subnet to an on-premises firewall or hub firewall by using a default route (0.0.0.0/0) can break APIM connectivity. This happens when outbound traffic is blocked or NATed in a way that no longer works with required Azure endpoints.

Supported guidance is:

If a default route from the APIM subnet points to the hub firewall or another network virtual appliance, enable service endpoints on the APIM subnet for these dependent services:
- Azure SQL
- Azure Storage
- Azure Event Hubs
- Azure Key Vault
With those service endpoints enabled, traffic from APIM to those Azure services uses the Azure backbone and is not force tunneled.
Any remaining APIM dependency traffic that is still force tunneled must be explicitly allowed through the firewall or virtual appliance. If that traffic is blocked, APIM might not function correctly.
If the requirement is to force tunnel all traffic from the APIM subnet, the firewall or virtual appliance must allow the complete IP address range of each dependent service and that configuration must be kept current as Azure infrastructure changes.
Be aware that force tunneling APIM traffic can introduce latency or unexpected timeouts.

For a hub-and-spoke design with APIM internal mode behind an internal Application Gateway, overriding the APIM subnet default route toward the hub firewall is therefore acceptable only when the APIM service dependencies are handled correctly. The safer documented pattern is to use service endpoints for the supported dependencies and ensure the hub firewall allows the remaining required outbound traffic.

References:

Deploy your Azure API Management instance to a virtual network - internal mode