1. The Problem: Public PaaS Endpoints

• Azure Storage, SQL, Key Vault, etc. are reachable over the internet by default (e.g., mystorageacct.blob.core.windows.net → public IP).
• Even with firewall rules, traffic traverses the Microsoft backbone but leaves the VNet boundary — violating zero-trust network segmentation.
• Compliance frameworks (PCI-DSS, HIPAA) often require data-plane traffic to stay on private networks end-to-end.

2. Service Endpoints vs Private Endpoints

3. Private Endpoint Architecture

• Private Endpoint — A network interface placed in your subnet with a private IP, mapped to a specific sub-resource (e.g., blob, sqlServer, vault).
• Private Link — The underlying platform that maps the PE NIC to the PaaS resource's data plane via Microsoft's backbone.
• Traffic never leaves Microsoft's network; no public IP exposure for the PaaS resource.
• PE supports sub-resource targeting: one PE per sub-resource (e.g., separate PEs for blob vs table on same storage account).

4. DNS Integration — The Critical Piece

• Private DNS Zones — Azure-managed DNS zones (e.g., privatelink.blob.core.windows.net) hosting A records for PE IPs.
• VNet Links — Link Private DNS Zone to each VNet needing resolution. Auto-registration optional.
• Azure DNS Private Resolver — Enables on-prem → Azure DNS queries (inbound endpoint) and Azure → on-prem (outbound endpoint + ruleset).
• Conditional Forwarding — On-prem DNS forwards *.privatelink.*.core.windows.net to Private Resolver inbound IP.
• Pitfall: Without correct DNS, clients resolve the public IP and bypass the PE — traffic blocked if public access is disabled.

5. Common Services with Private Endpoints

6. Private Link Service — Expose YOUR Service

• Private Link Service (PLS) — Place behind a Standard Load Balancer to expose your service to consumers in other VNets/tenants.
• Consumer creates a Private Endpoint that targets your PLS — gets a private IP in their VNet mapped to your LB frontend.
• Approval workflow — You control who can connect (auto-approve by subscription or manual approval).
• NAT — Consumer's source IP is NAT'd; you see traffic from the PLS NAT IP range, not the consumer's original IP.
• Use case: ISV SaaS platforms exposing APIs privately to enterprise customers without peering.

7. Disable Public Access

• Creating a PE alone does NOT block public access — you must explicitly disable it.
• Storage: Set publicNetworkAccess: Disabled or use "Allow access from selected VNets" with no entries.
• SQL: Set "Deny public network access" = Yes.
• Key Vault: Disable public access under Networking → Firewalls.
• Validate: From an external network, confirm connections are refused; from PE-enabled VNet, confirm connectivity.

🌍 Real-World Scenario

📝 Exam Tip

🧪 Knowledge Check