≈1.2k tokens on demand. Your agent reads this file only when SKILL.md points to it.
Networking (Traffic) Pairing Constraints
Application Gateway
| Paired With |
Constraint |
| Subnet |
Requires a dedicated subnet — no other resources allowed in the subnet (except other App Gateways). Cannot mix v1 and v2 SKUs on the same subnet — separate subnets required for each. |
| Public IP |
v2 SKU requires Standard SKU public IP with Static allocation. |
| NSG |
NSG on App Gateway subnet must allow GatewayManager service tag on ports 65200–65535 (v2) or 65503–65534 (v1). |
| WAF |
WAF configuration only available with WAF_v2 or WAF_Large/WAF_Medium SKUs. WAF v2 cannot disable request buffering — chunked file transfer requires path-rule workaround. |
| Zones |
v2 supports availability zones. Specify zones: ['1','2','3'] for zone-redundant deployment. |
| Key Vault |
For SSL certificates, use sslCertificates[].properties.keyVaultSecretId to reference Key Vault certificates. User-assigned managed identity required. |
| v1 Limitations |
v1 does not support: autoscaling, zone redundancy, Key Vault integration, mTLS, Private Link, WAF custom rules, or header rewrite. Must use v2 for these features. v1 SKUs are being retired April 2026. |
| Private-only (no public IP) |
Requires EnableApplicationGatewayNetworkIsolation feature registration. Only available with Standard_v2 or WAF_v2. |
| Global VNet Peering |
Backend via private endpoint across global VNet peering causes traffic to be dropped — results in unhealthy backend status. |
| kubenet (AKS) |
Kubenet is not supported by Application Gateway for Containers. Must use CNI or CNI Overlay. |
Front Door
| Paired With |
Constraint |
| Origins (backends) |
Origins are defined in child originGroups/origins. Supported origin types: App Service, Storage, Application Gateway, Public IP, custom hostname. |
| Private Link Origins |
Only available with Premium_AzureFrontDoor SKU. Enable private origin connections to App Service, Storage, Internal Load Balancer, etc. |
| WAF Policy |
WAF policies are separate Microsoft.Network/FrontDoorWebApplicationFirewallPolicies resources. Linked via security policy child resource on the profile. |
| Custom Domains |
Custom domains are child resources of the profile. Require DNS CNAME/TXT validation and certificate (managed or custom). |
| Application Gateway |
Front Door in front of App Gateway: use App Gateway public IP as origin. Set X-Azure-FDID header restriction on App Gateway to accept only Front Door traffic. |
| App Service |
Restrict App Service to Front Door traffic using access restrictions with AzureFrontDoor.Backend service tag and X-Azure-FDID header check. |
Load Balancer
| Paired With |
Constraint |
| Public IP |
Public IP SKU must match LB SKU. Basic LB requires Basic public IP; Standard LB requires Standard public IP. No cross-SKU mixing. |
| Standard SKU |
Backend pool VMs must be in the same VNet. No VMs from different VNets. Standard LB blocks outbound traffic by default — requires explicit outbound rules, NAT gateway, or instance-level public IPs. Standard LB requires an NSG (secure by default; inbound traffic blocked without NSG). |
| Basic SKU |
Backend pool VMs must be in the same availability set or VMSS. |
| Availability Zones |
Standard SKU is zone-redundant by default. Frontend IPs inherit zone from public IP. |
| VMs / VMSS |
VMs in backend pool cannot have both Basic and Standard LBs simultaneously. |
| Outbound Rules |
Only Standard SKU supports outbound rules. Basic SKU has implicit outbound. |
API Management
| Paired With |
Constraint |
| VNet (External) |
Only available with Developer, Premium, or Isolated SKU. Subnet must be dedicated with an NSG allowing APIM management traffic. |
| VNet (Internal) |
Same as External but no public gateway endpoint. Requires Private DNS or custom DNS for resolution. |
| Application Gateway |
Common pattern: App Gateway in front of Internal-mode APIM. App Gateway uses the APIM private IP as backend. |
| Key Vault |
Named values and certificates can reference Key Vault secrets. Requires managed identity with Key Vault Secrets User role. |
| Application Insights |
Set properties.customProperties with Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2 and logger resource for diagnostics. |
| NSG (VNet mode) |
Subnet NSG must allow: inbound on ports 3443 (management), 80/443 (client); outbound to Azure Storage, SQL, Event Hub, and other dependencies. |
