Private Endpoint
A private endpoint is a network interface with a private IP address in your VNet. It connects privately to a supported Azure PaaS resource. The resource is reached over the Microsoft backbone and can be locked down from public network access.
Private Link Service
Private Link service lets you publish your own service privately to consumers. The provider service usually sits behind a Standard Load Balancer. Consumers create private endpoints to access it.
DNS Is The Exam Trap
Private endpoints change name resolution. Public names need to resolve to private IP addresses from the networks that should use private access. That usually means Azure Private DNS zones linked to VNets, plus forwarding from on-premises DNS through DNS Private Resolver or custom DNS servers.
| Scenario | Required DNS pattern |
|---|---|
| Azure VM accesses storage account private endpoint | Private DNS zone linked to the VM VNet. |
| On-premises client accesses private endpoint | On-premises DNS forwards Azure private endpoint zone queries to Azure DNS path. |
| Hub-spoke private endpoint resolution | Private DNS zone linked to all required VNets, or centralized DNS forwarding. |
Service Endpoints
Service endpoints keep the Azure service public endpoint but allow the service to identify traffic as coming from a specific VNet/subnet. They are simpler than private endpoints but do not place the service on a private IP in your VNet.
Private Endpoint vs Service Endpoint
| Feature | Private Endpoint | Service Endpoint |
|---|---|---|
| Private IP in VNet | Yes | No |
| Uses public endpoint | No for client path | Yes |
| DNS complexity | Higher | Lower |
| On-premises private access | Yes, with VPN/ExpressRoute and DNS | Not the same private endpoint model |
| Most secure PaaS isolation answer | Usually yes | Useful but less private |
Access Controls
- Disable public network access where supported when using private endpoints.
- Approve private endpoint connections where manual approval is required.
- Use network rules and firewall settings on the PaaS service.
- Use private DNS zone groups to automate DNS record creation.
- Use service endpoint policies when service endpoint access must be restricted to specific resources.
Lab
- Create a storage account with public network access disabled.
- Create a private endpoint in a workload VNet.
- Create or attach the correct Private DNS zone.
- Test resolution and connectivity from Azure VM.
- Add hybrid DNS forwarding design notes for on-premises clients.
Feature Deep Dive
Private Endpoint Lifecycle
A private endpoint creates a NIC in your subnet. That NIC receives a private IP and maps to a specific subresource such as blob, file, vault, SQL server, or registry. Some services require separate private endpoints for separate subresources. The endpoint can be automatically approved or require manual approval depending on ownership and policy.
Private DNS Zone Groups
A private DNS zone group connects the private endpoint to the right Private DNS zone and creates the A record automatically. Without the DNS record, clients may still resolve the public endpoint and bypass the intended private path.
Hybrid Private Endpoint Access
On-premises clients can use private endpoints over VPN or ExpressRoute, but only if routing and DNS are both correct. The route must reach the VNet private IP, and DNS must resolve the public service name to that private IP. DNS Private Resolver is the managed option for this forwarding pattern.
Service Endpoint Policies
Service endpoint policies restrict which service resources can be reached through service endpoints. They are useful when a subnet should reach only approved storage accounts or service resources, but they do not replace Private Link for private IP access.
Common Exam Traps
- Thinking private endpoint traffic uses the service public IP. It uses the private endpoint IP.
- Disabling public access before DNS is working, then clients lose access.
- Forgetting separate private endpoint subresources.
- Expecting on-premises DNS to know Azure private zones without forwarding.
- Choosing service endpoints when the requirement says private IP, Private Link, or no public endpoint exposure.
Scenario Workshop: Key Vault Locked Down With Private Endpoint
Scenario: A Key Vault has public network access disabled and a private endpoint in a spoke VNet. An app in the same spoke works. An automation host on-premises fails to resolve the vault name correctly.
The fix is not a new Key Vault firewall rule if the requirement says private-only access. The fix is hybrid DNS plus network reachability to the private endpoint IP.
| Layer | Required design |
|---|---|
| Network | VPN or ExpressRoute route to the spoke or hub path that reaches the private endpoint IP. |
| DNS | On-premises DNS forwards vault private DNS zone queries to Azure. |
| Authorization | Identity still needs Key Vault permissions or RBAC. Private endpoint is not authorization. |
| Public access | Can remain disabled after private resolution works. |
Private Link Service Provider Flow
- Provider deploys a service behind a Standard Load Balancer.
- Provider creates a Private Link service associated with the load balancer frontend.
- Consumer creates a private endpoint targeting the provider service alias or resource.
- Provider approves the connection if manual approval is required.
- Consumer accesses the provider service through a private IP in the consumer VNet.
Security Boundary Reminder
Private Endpoint controls network path. It does not replace identity, RBAC, keys, firewall rules inside the service, or data-plane permissions. For example, a private endpoint to storage does not grant blob access; it only creates private network reachability.
Previous | Next: Part 9 - NSGs, ASGs, Flow Logs, and Bastion