Remove CloudService VIP address in Azure - azure

Question

We have a use case where we don't want to expose our cloud service to public and accessible only through our internal network. Is there a way to de associate the Public IP and access the cloud service through Internal IP. I already added CloudService to our VN but still i can access the CloudService through Public IP.
<NetworkConfiguration>
<VirtualNetworkSite name="xxxxVN" />
<AddressAssignments>
<InstanceAddress roleName="WorkerRole7">
<Subnets>
<Subnet name="default" />
</Subnets>
</InstanceAddress>
<InstanceAddress roleName="WebRole7">
<Subnets>
<Subnet name="default" />
</Subnets>
</InstanceAddress>
</AddressAssignments>
</NetworkConfiguration>
CSDEF:
<?xml version="1.0" encoding="utf-8"?>
<ServiceDefinition name="AzureCloudService7" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceDefinition" schemaVersion="2015-04.2.6">
<WebRole name="WebRole7" vmsize="Small">
<Sites>
<Site name="Web">
<Bindings>
<Binding name="Endpoint1" endpointName="Endpoint1" />
</Bindings>
</Site>
</Sites>
<ConfigurationSettings>
<Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" />
</ConfigurationSettings>
<Endpoints>
<InternalEndpoint name="Endpoint1" protocol="http" port="80" />
</Endpoints>
<Imports>
<Import moduleName="RemoteAccess" />
</Imports>
</WebRole>
<WorkerRole name="WorkerRole7" vmsize="Small">
<ConfigurationSettings>
<Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" />
</ConfigurationSettings>
<Imports>
<Import moduleName="RemoteAccess" />
<Import moduleName="RemoteForwarder" />
</Imports>
</WorkerRole>
</ServiceDefinition>>
when i removed Inputendpoint it is asking for binding, so i have given it as Internalendpoint and tried deploying it still am able to access the cloudservice with VIP.

Answer 1

The only ports available via the public load balancer (ie. the VIP) are the ones defined as InputEndpoints in your CSDEF file. So just remove those input endpoints and you will remove the ability to communicate to that VM from the public IP.