This article lists the network ports required for each component in the Turbo360 private hosting architecture. Use it as a reference when configuring network security group (NSG) rules, Azure Firewall policies, or any other traffic filtering layer in your private deployment.
Overview
Turbo360's private hosting model routes all traffic through Azure private endpoints and VNet integration. To allow the platform to function correctly, your network must permit specific ports between the App Service tier, the backing data services, and the identity and monitoring endpoints that Azure requires.
Business value
Having an accurate port reference reduces configuration errors during initial deployment and simplifies troubleshooting when connectivity issues occur. It gives your network team the exact rules to add without over-permitting traffic.
How it works
Traffic in a Turbo360 private deployment flows in two directions. Inbound traffic reaches the web and function apps via private endpoints exposed inside your VNet. Outbound traffic leaves the App Service integration subnet toward private endpoints for Azure SQL, Storage, Application Insights, Log Analytics, and notification channels. A separate set of public egress ports is required for Azure control plane and identity services that do not support private endpoints.
Inbound to the web/function apps (via private endpoint)
When a client calls your web app or function app via its private endpoint:
Source → Destination |
Port |
Purpose |
|---|---|---|
Client in VNet → App Service private endpoint |
443/TCP |
HTTPS for all HTTP-triggered requests |
App Service outbound via VNet integration
Web and function apps communicate outbound from the delegated integration subnet to private endpoints for other Azure services.
To Azure SQL private endpoint
1433/TCP — Default SQL Database port
11000–11999/TCP — Additional SQL data transfer ports (for MARS and bulk copy)
443/TCP — Required when using Azure AD authentication for SQL (token acquisition and redirect)
To Azure Storage private endpoint (Blob/File)
443/TCP — All Blob/File operations, including Run-From-Package ZIP load and content delivery
445/TCP — Access to storage file shares
To Application Insights private endpoint
443/TCP — Telemetry ingestion
To Log Analytics private endpoint
443/TCP — Logs ingestion (Log Analytics ingestion over HTTPS, even with Private Link)
Notification channels
25/TCP — SMTP server
587/TCP — SMTP server (TLS)
443/TCP — API-based notification channels (e.g. ServiceNow, Teams)
Azure control plane / identity
Even with private endpoints configured, the App Service still requires public egress on the following ports:
443/TCP — Entra ID endpoints (
login.microsoftonline.com,*.aadcdn.microsoftonline-p.com)443/TCP — Azure Resource Manager control plane
443/TCP — CRL/OCSP checks for TLS certificates
Internal DNS resolution
If using Azure Private DNS Zones:
53/UDP — DNS queries from the App Service outbound subnet to your DNS forwarder or Azure DNS
53/TCP — Fallback for large DNS responses