// Module included in the following assemblies:
//
// * post_installation_configuration/configuring-private-cluster.adoc
// * machine_management/control_plane_machine_management/cpmso_provider_configurations/cpmso-supported-features-azure.adoc

:_mod-docs-content-type: PROCEDURE
[id="private-clusters-setting-api-private-azure_{context}"]
= Restricting the API server to private for an {azure-full} cluster

[role="_abstract"]
If the security posture of your organization does not allow clusters to use an open API endpoint, you can restrict the API server to use only internal load balancers.
To implement this API server restriction, use the {azure-first} console to delete the external load balancer component.

.Prerequisites

* You have installed an {product-title} cluster on {azure-short}.
* You have access to the {azure-short} console as a user with administrator privileges.

.Procedure

. Log in to the {azure-short} console as a user with administrator privileges.

. Delete the following resources:

** The `api-v4` rule for the public load balancer.

** The `frontendIPConfiguration` parameter that is associated with the `api-v4` rule for the public load balancer.

** The public IP address that is specified in the `frontendIPConfiguration` parameter.

. Configure the Ingress Controller endpoint publishing scope to `Internal`.
For more information, see "Configuring the Ingress Controller endpoint publishing scope to Internal".

. Delete the `api.<cluster_name>` DNS entry in the public zone.

+
where `<cluster_name>` is the name of the cluster.
