How to connect to service bus explorer with public network access disabled

Question

How to connect to service bus explorer with public network access disabled

Cole Duprey 60

Hello,

I have what i believe is a proper set up for a service bus name space, private endpoint that links to a subnet and vnet and then a jumphost VM. I would like to look at a dead letter queue and i was expecting it to work with when connecting to the service bus explorer through the jumphost vm browser, but it still says i need to enable public network access of some kind. I did also did an nslookup <service-bus-namespace-name>.servicebus.windows.net and verified it is able to reach the service bus and its proper IP, so all configuration should be the same. I heard there was some kind of Service Bus Explorer application as well, but was wondering what the industry standard would be here as i was unable to find a lot of information about it.

Regards

Siddhesh Desai 6,555 Reputation points Microsoft External Staff Moderator

2026-01-07T15:34:42.6466667+00:00
Hi @Cole Duprey

Thank you for reaching out to Microsoft Q&A.

According to this MS Document https://learn.microsoft.com/en-us/azure/service-bus-messaging/explorer, In order for Service bus explorer to work within Private Network:

If your Service Bus namespace can only be accessed via a private endpoint, you must run your web browser on a host in the virtual network with the private endpoint, and also ensure that there are no network security groups (NSGs) in the way. Ensure that you're a member of one of these roles on the namespace or the entities you want to execute send or receive (including peek and purge) operations on:

Service Bus Data Owner; Allows both send and receive operations.

Service Bus Data Sender; Allows send operations.

Service Bus Data Receiver; Allows receive operations.

Also, Enable Allow trusted Microsoft Services to Bypass this firewall setting in the Networking tab.

Make sure you have

You can download the Open-source Service bus explorer client in the Jump VM from here: https://github.com/paolosalvatori/ServiceBusExplorer
Cole Duprey 60 Reputation points

2026-01-07T17:03:55.48+00:00

Hello,

I have found a resolution. There is a large orange warning when you have public access disabled that states "This namespace has public network access disabled, data operations such as Peek, Send or Receive against this Service Bus entity will not work until you switch to all networks or allowlist your client IP in selected networks."

However, there is another warning that explicitly says to ignore the message when you allow "Selected Networks"" "This namespace has public network access from Selected networks, data operations such as Peek, Send or Receive against this Service Bus entity will not work until you add client IP address to the list of allowed addresses under Firewall section. You can add this Portal's client IP address by switching to the Networking Tab of the namespace. Ignore this warning if you have already whitelisted the client IP address."

Either way, the messages can be ignored and it will still work, but the misleading messaged at first caused me not to even attempt to Peek from Start. Not much time was lost, but a similar issue could happen to another. Maybe a more detailed message could be added in the future for those with private networking set ups that way there isnt any confusion.

Thank you for your assistance!

Regards,

Cole
Siddhesh Desai 6,555 Reputation points Microsoft External Staff Moderator

2026-01-09T08:51:17.3933333+00:00

Hi @Cole Duprey

Glad you were able to find the resolution.

I have posted the answer referencing that document that says this warning can be ignored.

Please click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you.

Answer accepted by question author

1 additional answer

Your answer

Siddhesh Desai 6,555 Reputation points Microsoft External Staff Moderator

2026-01-07T15:34:42.6466667+00:00

Hi @Cole Duprey

Thank you for reaching out to Microsoft Q&A.

According to this MS Document https://learn.microsoft.com/en-us/azure/service-bus-messaging/explorer, In order for Service bus explorer to work within Private Network:

If your Service Bus namespace can only be accessed via a private endpoint, you must run your web browser on a host in the virtual network with the private endpoint, and also ensure that there are no network security groups (NSGs) in the way. Ensure that you're a member of one of these roles on the namespace or the entities you want to execute send or receive (including peek and purge) operations on:

Service Bus Data Owner; Allows both send and receive operations.

Service Bus Data Sender; Allows send operations.

Service Bus Data Receiver; Allows receive operations.

Also, Enable Allow trusted Microsoft Services to Bypass this firewall setting in the Networking tab.

Make sure you have

You can download the Open-source Service bus explorer client in the Jump VM from here: https://github.com/paolosalvatori/ServiceBusExplorer
Cole Duprey 60 Reputation points

2026-01-07T17:03:55.48+00:00

Hello,

I have found a resolution. There is a large orange warning when you have public access disabled that states "This namespace has public network access disabled, data operations such as Peek, Send or Receive against this Service Bus entity will not work until you switch to all networks or allowlist your client IP in selected networks."

However, there is another warning that explicitly says to ignore the message when you allow "Selected Networks"" "This namespace has public network access from Selected networks, data operations such as Peek, Send or Receive against this Service Bus entity will not work until you add client IP address to the list of allowed addresses under Firewall section. You can add this Portal's client IP address by switching to the Networking Tab of the namespace. Ignore this warning if you have already whitelisted the client IP address."

Either way, the messages can be ignored and it will still work, but the misleading messaged at first caused me not to even attempt to Peek from Start. Not much time was lost, but a similar issue could happen to another. Maybe a more detailed message could be added in the future for those with private networking set ups that way there isnt any confusion.

Thank you for your assistance!

Regards,

Cole
Siddhesh Desai 6,555 Reputation points Microsoft External Staff Moderator

2026-01-09T08:51:17.3933333+00:00

Hi @Cole Duprey

Glad you were able to find the resolution.

I have posted the answer referencing that document that says this warning can be ignored.

Please click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you.

Answer 1

Hi @Cole Duprey

Thank you for reaching out to Microsoft Q&A.

Glad you were able to find the resolution.

I am posting this as an answer to help other community members.

As per this MS Document: https://learn.microsoft.com/en-us/azure/service-bus-messaging/explorer

When you navigate to Service Bus explorer for an entity in a namespace that has the public access disabled, you see the following message even though you access it from a virtual machine that's in the same virtual network as the private endpoint. You can ignore the warning below: "The namespace has public network access disabled. Data operations such as Peek, Send, or Receive against this Service Bus entity don't work until you switch to all networks or allowlist your client IP in selected networks."

It's safe to ignore the warning and peek the message if your jumphost vm is in the same vnet as the private endpoint connected to service bus.

Answer 2

To connect to the Service Bus Explorer when public network access is disabled, you need to ensure that your configuration allows for private network access. Here are the steps to troubleshoot and ensure proper access:

Private Endpoint Configuration: Make sure that your private endpoint is correctly set up and linked to the subnet and virtual network (VNet) where your jumphost VM resides.
Access from Jumphost VM: Since you are accessing the Service Bus Explorer from a jumphost VM, ensure that this VM is within the same VNet as the private endpoint. If the VM is not correctly configured, it may not be able to access the Service Bus.
Service Bus Explorer: Use the Service Bus Explorer application to perform operations on the Service Bus. To access it, navigate to the Service Bus namespace and select the appropriate queue or topic. Note that you may need to select the specific subscription if you're working with a topic.
Public Network Access Message: If you see a message indicating that public network access is disabled, it means that operations like Peek, Send, or Receive cannot be performed until you either enable public access or ensure that your client IP is allowlisted in the selected networks.
Testing Connectivity: You can run nslookup <YourNamespaceName>.servicebus.windows.net from the jumphost VM to verify that it can resolve the Service Bus namespace correctly. If it resolves to the correct IP, your DNS configuration is likely correct.

If you continue to face issues, consider reviewing the network security group (NSG) rules and ensuring that the necessary ports are open for communication between your jumphost VM and the Service Bus.

References:

Share via

How to connect to service bus explorer with public network access disabled

1 additional answer

Your answer