Azure Managed Grafana + private endpoint failing behind app gateway

Question

Azure Managed Grafana + private endpoint failing behind app gateway

Ashish K Padhy 20

Hello,

I have configured azure managed grafana with private endpoint + disable public access and placed it behind application gateway. Can able to access application gatewate grafana frontend url but its failing after authentication using sso. Any help really appreciated

Thank you

Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-08T17:37:18.68+00:00

Hello Ashish K Padhy

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,

Suchitra.
Ashish K Padhy 20 Reputation points

2026-04-09T10:05:14.0333333+00:00
Hello @Suchitra Suregaunkar , Thank you for impressive support.

After reading your reply, I feel we are almost there with solution but here I need more detailed solution

Issue details

Region: East US

Managed Grafana resource name: amg-ap-eus-eph

Managed Grafana endpoint(by Microsoft) : https://amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com

Vanity URL via Application Gateway: https://grafana.eph-uais.opum.com

Public network access on Managed Grafana: Disabled

Private endpoint configured: Yes (approved state)

Private endpoint resolved IP: 10.71.152.180

Application gateway frontend url is https://grafana.eph-xyz.opum.com

As, amg hardcode the url, in vnet level this url FQDN amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com resolved to private ip i.e 10.71.152.180

Application Gateway configuration

Listener : grafana.eph-xyz.opum.com

backend bool host : amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com

Queries :

What Microsoft Entra ID endpoints need to allow? Please share list of endpoints

How to define AzureActiveDirectory service tag in NSG or Firewall?

What rewrites need to define in Application gateway ? As I have shared all details, can you please draft syntax

Please help me to get above details, it will appreciated .

I want to thank you great support. Its appreciated

Thank you

Ashish
Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-09T10:09:03.2566667+00:00

Hello Ashish K Padhy

Thanks for responding back. Please allow me sometime and I will update you regarding your query.
Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-09T10:33:25.83+00:00
Hello Ashish K Padhy

Please have a look into below resolutions for your queries:

What Microsoft Entra ID endpoints need to allow?

When AMG is deployed in Private Endpoint mode, OAuth authentication still happens against public Microsoft Entra ID endpoints.

Authentication flow:

Browser → Entra ID → Token issuance → Redirect back to AMG

Applications request token from Microsoft Entra ID using browser connection to Entra authentication endpoints

Reference: https://docs.azure.cn/en-us/entra/architecture/authenticate-applications-and-users#request-tokens

And when service is deployed in private subnet, authentication traffic must reach:

login.microsoftonline.com

to obtain tokens.

Reference: https://docs.nginx.com/nginxaas/azure/quickstart/security-controls/private-subnet-oidc-entra/

Please have a look into below required outbound endpoints (Allow over 443).

Allow following:

login.microsoftonline.com login.microsoft.com sts.windows.net graph.microsoft.com account.activedirectory.windowsazure.com aadcdn.msftauth.net *.microsoftonline.com *.msauth.net *.msftauth.net

Blocking these breaks OAuth SSO handshake.

Reference: https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/Servers/MicrosoftEntraID/AuthenticationMicrosoftEntraIDAllowURL/index.html

How to define AzureActiveDirectory Service Tag in NSG / Firewall?

Microsoft recommends Service Tags instead of hardcoding IPs because Service tag represents group of IP prefixes of Azure service and Microsoft automatically updates them as address ranges change

You can Use Service Tag in NSG, Azure Firewall, UDR. Instead of maintaining Entra ID IP ranges manually.

There is a specific tag which represents Microsoft Entra ID authentication endpoints

AzureActiveDirectory

https://dori-uw-1.kuma-moon.com/en-us/azure/virtual-network/service-tags-overview

NSG RULE (Outbound):

Create this rule on App Gateway Subnet and Private Endpoint Subnet (if firewall applied)

Use Azure CLI:

az network nsg rule create --resource-group <RG> --nsg-name <NSG-NAME> --name Allow-AAD-OAuth --priority 200 --direction Outbound --access Allow --protocol Tcp --destination-port-ranges 443 --destination-address-prefixes AzureActiveDirectory

Now AMG backend can talk to Entra ID securely without opening Internet.

Application Gateway Rewrite Rules:

Microsoft Application Gateway supports modifying request and response headers between client and backend and also Response Location header can be rewritten before reaching client.

This is exactly what AMG SSO requires.

References:

Rewrite HTTP headers and URL with Application Gateway - https://dori-uw-1.kuma-moon.com/en-us/azure/application-gateway/rewrite-http-headers-url

Rewrite HTTP request and response headers with Azure Application Gateway - Azure portal - https://dori-uw-1.kuma-moon.com/en-us/azure/application-gateway/rewrite-http-headers-portal

Rewrite is Required because, After login, Entra ID redirects browser to:

https://amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com/login/azuread

But:

Public access = Disabled Browser cannot access Private Endpoint directly

So AppGW must intercept this redirect and convert to:

https://grafana.eph-xyz.opum.com/login/azuread

Please try below implementation using Azure CLI:

Step 1: Create Rewrite Rule Set

az network application-gateway rewrite-rule set create --resource-group <RG> --gateway-name <APPGW-NAME> --name grafanaRewriteSet

Step 2 : REQUEST HEADER REWRITE, (Vanity → AMG Host)

az network application-gateway rewrite-rule create --resource-group <RG> --gateway-name <APPGW-NAME> --rule-set-name grafanaRewriteSet --name rewriteHostHeader --sequence 100 --request-headers "Host=amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com"

Step 3: RESPONSE HEADER REWRITE, (AMG Redirect → Vanity URL)

This captures redirect from AMG:

Location: https://amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com

and replaces with:

https://grafana.eph-xyz.opum.com

First Create Condition:

az network application-gateway rewrite-rule condition create \az network application-gatewayRG> --gateway-name <APPGW-NAME> --rule-set-name grafanaRewriteSet --rule-name rewriteHostHeader --variable http_resp_Location --pattern amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com --ignore-case true

Then Response Rewrite:

az network application-gateway rewrite-rule create --resource-group <RG> --gateway-name <APPGW-NAME> --rule-set-name grafanaRewriteSet --name rewriteLocationHeader --sequence 110 --responsegrafana.eph-xyz.opum.com"

Step 4 : Attach Rewrite Rule To Routing Rule.

az network application-gateway rule update --resource-group <RG> --gateway-name <APPGW-NAME> --name <ROUTING-RULE-NAME> --rewrite-rule-set grafanaRewriteSet

Azure AD App Registration Redirect URI Must include BOTH:

https://grafana.eph-xyz.opum.com/login/azuread https://amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com/login/azuread

When a user accesses the Grafana instance using the vanity URL (grafana.eph-xyz.opum.com), the request is routed through the Application Gateway to the Azure Managed Grafana private endpoint; after successful authentication with Microsoft Entra ID, the service redirects the response to the Managed Grafana workspace FQDN, which is then intercepted by the Application Gateway and rewritten back to the vanity URL, allowing the login process to complete successfully while maintaining private access.

Azure Managed Grafana internally utilizes its workspace FQDN in the OAuth authentication flow. When public network access is disabled, the browser cannot directly reach this FQDN after successful sign‑in, resulting in authentication failures. Configuring Azure Application Gateway to rewrite request Host headers and response Location headers ensures that OAuth redirect responses are routed back through the vanity URL, allowing authentication to complete successfully while maintaining private endpoint access.

Thank You.
Ashish K Padhy 20 Reputation points

2026-04-09T12:30:19.93+00:00

Great. Thank you for all support and its very briefed step by step information. Appreciated

Query :

How to do Azure AD App Registration Redirect URI Must include BOTH: ?

Answer accepted by question author

1 additional answer

Your answer

Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-08T17:37:18.68+00:00

Hello Ashish K Padhy

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,

Suchitra.
Ashish K Padhy 20 Reputation points

2026-04-09T10:05:14.0333333+00:00

Hello @Suchitra Suregaunkar , Thank you for impressive support.

After reading your reply, I feel we are almost there with solution but here I need more detailed solution

Issue details

Region: East US

Managed Grafana resource name: amg-ap-eus-eph

Managed Grafana endpoint(by Microsoft) : https://amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com

Vanity URL via Application Gateway: https://grafana.eph-uais.opum.com

Public network access on Managed Grafana: Disabled

Private endpoint configured: Yes (approved state)

Private endpoint resolved IP: 10.71.152.180

Application gateway frontend url is https://grafana.eph-xyz.opum.com

As, amg hardcode the url, in vnet level this url FQDN amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com resolved to private ip i.e 10.71.152.180

Application Gateway configuration

Listener : grafana.eph-xyz.opum.com

backend bool host : amg-ap-eus-eph-dmang7hpexe9.eus.grafana.azure.com

Queries :

What Microsoft Entra ID endpoints need to allow? Please share list of endpoints

How to define AzureActiveDirectory service tag in NSG or Firewall?

What rewrites need to define in Application gateway ? As I have shared all details, can you please draft syntax

Please help me to get above details, it will appreciated .

I want to thank you great support. Its appreciated

Thank you

Ashish
Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-09T10:09:03.2566667+00:00

Hello Ashish K Padhy

Thanks for responding back. Please allow me sometime and I will update you regarding your query.
Ashish K Padhy 20 Reputation points

2026-04-09T12:30:19.93+00:00

Great. Thank you for all support and its very briefed step by step information. Appreciated

Query :

How to do Azure AD App Registration Redirect URI Must include BOTH: ?

Answer 1

Hello Ashish K Padhy It sounds like you’ve got Azure Managed Grafana locked down behind a Private Endpoint and Application Gateway — you can hit the Grafana login page, but the SSO/OAuth flow is failing. In most cases that’s because even “private-only” Grafana still needs outbound access to public Microsoft Entra ID endpoints (like login.microsoftonline.com, graph.microsoft.com, etc.) to complete the OAuth handshake. When you disable public access and lock down your subnets, those calls get blocked.

Here’s what you can try:

Allow outbound to the Microsoft Entra ID endpoints : • If you’re using an NSG or Firewall, add rules or use the AzureActiveDirectory service tag (or explicitly allow FQDNs: login.microsoftonline.com, graph.microsoft.com, sts.windows.net, etc.) • This ensures Grafana can reach the identity provider even though the workspace itself isn’t publicly accessible.
Verify your private endpoint & DNS setup: • In the Azure portal, go to your Managed Grafana > Networking > Private Access and confirm the endpoint state is “Approved.” • Ensure you’ve integrated with a private DNS zone so that your Grafana hostname resolves correctly inside the VNet.
Check your Application Gateway HTTP settings: • Make sure you’re forwarding the original Host header (or rewriting back to the Grafana FQDN) so Grafana sees the exact URL you’ve registered in Azure AD. • If the host header is wrong, the redirect URI won’t match what’s in your app registration.
Double-check your Azure AD app registration : • In Entra ID, under your Grafana enterprise app, verify the Redirect URI exactly matches the Application Gateway URL (including protocol, hostname, and path, e.g., https://grafana.mycompany.com/login/azuread). • If you’ve got multiple environments or funky hostnames, make sure each one is listed.

If you’re still seeing an error after those steps, could you share:

• The exact error message or behavior after you submit credentials

• How your Azure AD app’s redirect URI is configured

• Any NSG/firewall rules you’ve set on the subnet hosting Grafana

• Whether you’ve tested DNS resolution for both the Grafana FQDN and the Entra endpoints from a VM in the same VNet

That info will help narrow it down!

Hope that helps — let me know what you see.

References

Set up private access in Azure Managed Grafana: https://dori-uw-1.kuma-moon.com/azure/managed-grafana/how-to-set-up-private-access
Troubleshoot managed private endpoint connections: https://dori-uw-1.kuma-moon.com/azure/managed-grafana/troubleshoot-mpe-connection
Connecting Grafana to Azure Data Explorer privately: https://dori-uw-1.kuma-moon.com/azure/managed-grafana/how-to-connect-to-data-source-privately

Thanks,
Suchitra.

Answer 2

When Azure Managed Grafana is configured with a private endpoint and public access is disabled, all access must go through that private endpoint. This has two important implications for the scenario:

The Azure portal and some features cannot reach the workspace over the internet
- Disabling public access “prevents all traffic from accessing the resource unless you go through a private endpoint.”
- Specifically, when private access is enabled, the Pin to Grafana feature in the Azure portal no longer works because the portal cannot reach a workspace that is only on a private IP.
- This is expected behavior and is called out as a trade-off when hardening network security.
Azure Managed Grafana does not support connecting to private networks as data sources
- For data sources and backend calls, Azure Managed Grafana “doesn't currently support connections to private networks.”
- If any part of the SSO flow or callback path (for example, redirects that must reach the Grafana endpoint) relies on a path that is only reachable over a private network in a way that conflicts with this model, the authentication flow can fail after login.

Recommended checks and adjustments:

Confirm network model and routing
- Ensure that the Application Gateway, the private endpoint, and the clients are all in a network topology where the private endpoint IP is reachable end to end.
- Verify that all user access to Grafana is over HTTPS on port 443 through the private endpoint, as Azure Managed Grafana uses HTTPS/443 only.
Validate that public network access is intentionally disabled
- In the Azure portal, open the Azure Managed Grafana workspace → Settings → Networking and confirm Public Access is set to Disabled.
- If testing or troubleshooting, temporarily set Public Access to Enabled to see if SSO succeeds when the workspace is reachable over the public endpoint. If it works publicly but fails privately, the issue is with private endpoint/App Gateway routing or headers.
Review data source and backend connectivity
- Ensure that no data source or dependency in the authentication flow is configured to use a private IP that Azure Managed Grafana cannot reach, as “Azure Managed Grafana doesn't currently support connections to private networks.”
Apply recommended network security patterns
- Use private endpoints and disable public network access as recommended, but ensure that all required traffic (including SSO redirects) is allowed through the Application Gateway and the private endpoint.
- Configure NSGs and firewalls so that HTTPS traffic from clients via the Application Gateway to the private endpoint is permitted.

If SSO continues to fail only when going through the private endpoint/App Gateway, re-test with public access enabled to isolate whether the failure is due to network reachability versus identity configuration.

References:

Share via

Azure Managed Grafana + private endpoint failing behind app gateway

1 additional answer

Your answer