Virtual network integration depends on a dedicated subnet. https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration#regional-virtual-network- integration For outgoing traffic from Web App to vnet, it will go through Internet, so the cost not the minimum. The connection between the Private Endpoint and the Web App uses a secure Private Link. Private Endpoint is only used for incoming flows to your Web App. Outgoing flows will not use this Private Endpoint, but you can inject outgoing flows to your network in a different subnet through the VNet integration feature. https://docs.microsoft.com/en-us/azure/app-service/networking/private-endpoint#conceptual-overview