<p>From the <a href="https://azure.microsoft.com/en-us/pricing/details/api-management/" rel="nofollow noreferrer">Azure API management pricing page</a> I see that Virtual Networks aren't supported besides the Developer and Premium tiers.</p>

<p>Currently with my developer tier subscription when configuring the VN of an APIM I can choose between "off", "External" and "Internal". With the other tiers, can I still use an External VN or no VN at all?</p>

<p>When I try to connect a kubernetes cluster/VM to the APIM, I have to configure the APIM with an external VN. So if that's not possible with the other subscription tiers, is it still possible to connect to a kubernetes cluster?</p>

Jurgy
<p>VNET Support (and hence the options) are available only in the Developer and Premium Tiers.</p>

<p>You can still use APIM by routing requests from APIM to the <a href="https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard" rel="nofollow noreferrer">AKS load balancer</a> using a <a href="https://learn.microsoft.com/en-us/azure/aks/static-ip" rel="nofollow noreferrer">static IP</a> and overriding the <code>Host</code> header as required. If possible, you could also use <a href="https://github.com/Azure/application-gateway-kubernetes-ingress" rel="nofollow noreferrer">Azure Application Gateway as an ingress controller</a> too.</p>

<p><strong>When taking the load balancer approach,</strong> you could setup a <a href="https://learn.microsoft.com/en-us/azure/virtual-network/security-overview" rel="nofollow noreferrer">Network Security Group</a> to allow traffic only from APIM (and any other IPs/Services) to your AKS nodes.</p>

<p><strong>When taking the Application Gateway approach,</strong> you could setup <a href="https://learn.microsoft.com/en-us/azure/application-gateway/configuration-overview#allow-application-gateway-access-to-a-few-source-ips" rel="nofollow noreferrer">IP restrictions</a> to APIM.</p>

<p>You should be able to setup a similar source IP rule on your own ingress controller too instead of an NSG rule I suppose.</p>
