I've got an azure web app and I'm trying to set the custom domain and assign a ssl cert (TLS/SSL binding). The plan as of now is to assign a custom domain, ex: web.abc.com then assign a wildcard ssl certificate to the web app (ex, *.abc.com).
When you add the custom domain it needs to be validated from external dns registrar. The plan is for this app to only be accessible from our internal network and not publicly accessible over the internet. We would implement VNet integration to lock down the network access.
Here's my question - if the app isn't going to be publicly accessible do CNAME records need to be created in our external registrar or can I get by with only creating a CNAME record on our internal DNS server?