Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.unstructured.io/llms.txt

Use this file to discover all available pages before exploring further.

This page covers how to establish private connectivity between your dedicated instance and services running in your Azure environment that you self-host, such as MongoDB, Elasticsearch, or applications behind Azure API Management in internal VNet mode. For Azure-managed services that support Private Endpoint access natively (Blob Storage, Azure OpenAI, AI Search, Azure SQL, Cosmos DB, PostgreSQL, MySQL, Synapse, Azure Databricks), see Connecting to Azure-managed services.

​
How it works

Customer-managed services on Azure require you to front them with an Azure Standard Load Balancer and expose them via a Private Link Service. Unstructured then creates a Private Endpoint in the Unstructured-managed environment to connect to your service privately. In Azure terminology, you are the service provider and Unstructured is the service consumer.

​
Information exchange

The table below uses Order to indicate the general sequence of the information exchange — items with the same Order value can usually be provided at the same stage. The <DI_AZURE_SUBSCRIPTION_ID> value is a placeholder; contact your Unstructured account team or open a ticket in the Unstructured Support Portal to get the actual value for your dedicated instance.
Your service must be in the same Azure region as your dedicated instance — cross-region Private Link is not supported. The example region code in the table below is illustrative; use the region your dedicated instance is deployed in. See Known limitations.
OrderInformation RequiredDescriptionExampleProvided by
1Service TypeThe service being accessedMongoDB, Elasticsearch, Internal APICustomer
1Service RegionAzure region where the service is hostedeastusCustomer
1Service PortPort(s) the service listens on27017 (MongoDB), 9200 (Elasticsearch), 443Customer
2Unstructured Azure Subscription IDSubscription ID to add to the visibility settings of your Private Link Service<DI_AZURE_SUBSCRIPTION_ID>Unstructured
3Private Link Service Resource IDFull resource ID of your Private Link Service/subscriptions/.../providers/Microsoft.Network/privateLinkServices/customer-app-plsCustomer
3Service EndpointThe endpoint hostname or IP for connectionCustom DNS or Private Link Service aliasCustomer

​
Steps

​
Step 1: Provide service information

Provide Unstructured with the service type, region, and port via support ticket. Unstructured will share the Unstructured Azure Subscription ID you need to complete Step 3. Deploy an Azure Standard Load Balancer in front of your service, then create a Private Link Service attached to the load balancer’s frontend IP configuration. Learn how. Using the Azure CLI: 
az network private-link-service create \
  --name "customer-app-pls" \
  --resource-group "<RESOURCE_GROUP>" \
  --vnet-name "<VNET_NAME>" \
  --subnet "<SUBNET_NAME>" \
  --lb-name "<LOAD_BALANCER_NAME>" \
  --lb-frontend-ip-configs "<FRONTEND_IP_CONFIG_NAME>" \
  --location "<REGION>"
Replace:
  • <RESOURCE_GROUP> — Resource group for the Private Link Service and related resources
  • <VNET_NAME> — Virtual network name
  • <SUBNET_NAME> — Subnet used for the Private Link Service (must meet Azure subnet requirements for Private Link)
  • <LOAD_BALANCER_NAME> — Name of the Standard Load Balancer fronting your application
  • <FRONTEND_IP_CONFIG_NAME> — Frontend IP configuration name on the load balancer
  • <REGION> — Azure region (for example eastus)
Update the visibility settings on your Private Link Service to include Unstructured’s Azure Subscription ID so Unstructured can create a Private Endpoint connecting to it. Learn how. Provide Unstructured with your Private Link Service Resource ID and service endpoint via support ticket. Unstructured will create a Private Endpoint in the Unstructured-managed environment targeting your service.

​
Step 5: Approve Unstructured’s connection request

Once Unstructured creates the Private Endpoint, a connection request appears on your Private Link Service. Approve it as soon as possible to avoid delays. Learn how. Using the Azure CLI: 
az network private-link-service connection approve \
  --resource-group "<RESOURCE_GROUP>" \
  --service-name "customer-app-pls" \
  --name "<CONNECTION_NAME>"
Replace <CONNECTION_NAME> with the name of the pending connection request (shown in the Azure portal or provided by Unstructured).

​
Private API Gateway use case

If your application uses Azure API Management in private-only (internal VNet) mode, you cannot target the API Management resource directly with a Private Link Service. Deploy an Azure Standard Load Balancer in front of API Management and create a Private Link Service that points to the load balancer.

​
Questions? Need help?

Contact your Unstructured account team or open a ticket in the Unstructured Support Portal.