Microsoft Azure · Expert
Microsoft Certified: Azure Solutions Architect Expert
Private Endpoints, VNet rules and CMK require Premium-tier namespaces, which are billed per messaging unit. Standard supports IP firewall rules. This pattern uses Standard with Entra ID-only auth: if the requirement is private networking, you have to move to Premium. In AWS, SQS connects through an interface VPC endpoint.
If the worker dies after processing but before completing the message, the lock expires and the message is redelivered. It's the same model as SQS's visibility timeout. Service Bus duplicate detection dedupes repeated sends, not processing: the worker must be idempotent.
Inbound and outbound can't share a subnet: each goes in a dedicated /28 to /24, delegated to Microsoft.Network/dnsResolvers and with no other resources. There's one resolver per VNet, rulesets only link to VNets in the same region, and it doesn't work with IPv6 subnets or VNets with virtual network encryption. Reserve both /28s in the hub design before the address space fills up.
If a partner manages the customer's tenant with Lighthouse, it can't operate the resolver that way: it needs direct access in the tenant. It also doesn't support ExpressRoute FastPath or linking rulesets across tenants. For an MSP that's a day-one design decision, not an implementation detail.
The connectivity mode is set at server creation and can't be changed. A VNet-integrated server doesn't support Private Endpoints and can't be moved to another subnet or VNet. This module uses "public access" mode with public_network_access_enabled = false + Private Endpoint, which lets it be consumed from hub-and-spoke, peerings and on-premises with the same model as other PaaS services.
Entra principals are added as administrators from the Azure portal or the ARM API. With isAdmin=true, pgaadauth_create_principal gives them azure_pg_admin, CREATEROLE and CREATEDB. For the app identity to be a regular user, an Entra admin can run pgaadauth_create_principal('<name>', false, false). For managed identities and service principals the name is the display name. The module outputs the exact SQL.
Letra Chica