Networking Networking field-manual-complete

Private Endpoint

A private endpoint gives an Azure service a private IP address inside your virtual network. Instead of your app reaching a storage account, database, vault, or AI service through a public endpoint, traffic goes to a private network interface tied to that service. The service still exists as a managed Azure resource; the endpoint is the private doorway to it. DNS, firewall rules, approval state, and public network access settings decide whether the design is actually private and usable.

Aliases
private link endpoint
Difficulty
advanced
CLI mappings
5
Last verified
2026-05-20

Microsoft Learn

A private endpoint is a network interface with a private IP address from your virtual network. It connects clients privately to a supported Azure service through Azure Private Link, effectively bringing that service into the virtual network.

Microsoft Learn: What is a private endpoint?2026-05-20

Technical context

In Azure architecture, a private endpoint sits in the networking data path as a managed network interface in a subnet. It connects to a specific Private Link resource and target subresource, such as blob, file, sqlServer, vault, or account. The endpoint has connection state, DNS zone groups, a private IP, and integration with virtual network routing. It is controlled through Azure Resource Manager but affects data-plane access. Architects pair it with private DNS zones, service firewalls, RBAC, managed identity, and often hub-and-spoke network patterns.

Why it matters

Private endpoints matter because they change exposure. They let workloads consume platform services without sending traffic over public internet paths, which is critical for regulated data, internal applications, and zero-trust network designs. They also create operational responsibility: the endpoint alone does not disable public access, does not grant identity permissions, and does not fix DNS automatically in every topology. Misconfigured private endpoints can break production with confusing symptoms, especially when DNS still points to public addresses or a service firewall blocks the private connection. Used well, private endpoints create a clear, inspectable boundary between consuming networks and managed Azure services.

Where you see it

Signals, screens, and Azure surfaces where this term usually becomes operational.

Signal 01

The Private Endpoint portal blade shows connection status, target resource, subresource group ID, subnet, network interface, private IP, DNS zone groups, and approval history. during production validation and incident triage

Signal 02

Azure CLI output from az network private-endpoint show exposes provisioning state, custom DNS configs, network interface IDs, manual request messages, and private link service connections.

Signal 03

Application dependency failures, storage firewall denies, Key Vault connection errors, and nslookup results often reveal whether traffic is using the private endpoint path during incidents.

When this becomes relevant

Specific situations where this term helps solve real Azure design, operations, migration, security, reliability, cost, or governance problems.

  • Expose a storage account, vault, database, or AI service to a workload subnet without allowing broad public network access.
  • Meet compliance requirements that require managed service traffic to stay on private network paths and approved VNets.
  • Connect an application spoke to a shared platform service while central DNS and security teams retain governance control.
  • Support partner or cross-subscription access where the service owner approves each private endpoint connection explicitly.
  • Reduce incident uncertainty by creating an inspectable private access path with known source network, target service, and DNS records.

Real-world case studies

Different enterprise-style examples that show the term being used to hit measurable objectives.

Case study 01

Insurance claims platform removes public access to evidence storage

Scenario, objectives, solution, measured impact, and takeaway.

Scenario

An insurance carrier stored photos, police reports, and repair documents in Azure Storage for a claims application. Security reviewers found that firewall exceptions and shared keys made the public endpoint too broad for the sensitivity of the evidence data.

Business/Technical Objectives
  • Allow only the claims application subnet to reach the storage account.
  • Disable public network access after proving private connectivity.
  • Preserve existing application hostnames and SDK behavior.
  • Capture evidence for cyber-insurance and regulatory reviews.
Solution Using Private Endpoint

The platform team created a private endpoint for the storage blob subresource in the application spoke VNet and integrated it with the central private DNS zone. The storage account firewall was first set to selected networks, then public network access was disabled after successful workload tests. Managed identity replaced shared-key usage for the claim-processing service. Azure CLI checks captured the private endpoint connection state, DNS records, target resource ID, and storage account public network access setting. Application Insights dependency telemetry confirmed traffic remained stable during the cutover window.

Results & Business Impact
  • Public storage exposure was removed for the claims evidence account.
  • Claims document retrieval latency stayed within the existing 120 ms dependency budget.
  • Firewall exception review time dropped from two days to less than one hour.
  • The audit package included endpoint, DNS, identity, and storage access evidence.
Key Takeaway for Glossary Readers

A private endpoint is strongest when paired with DNS, identity, and target-service network controls instead of treated as a standalone checkbox.

Case study 02

Gaming studio protects telemetry ingestion during launch week

Scenario, objectives, solution, measured impact, and takeaway.

Scenario

A gaming studio prepared a new multiplayer title and expected telemetry bursts from regional game servers. The ingestion path used Event Hubs, but leadership wanted server-to-service traffic off public endpoints during the launch window.

Business/Technical Objectives
  • Route game-server telemetry to Event Hubs over private network paths.
  • Avoid last-minute firewall changes during launch week.
  • Keep ingestion observable if packet loss or throttling appeared.
  • Separate production telemetry access from developer test networks.
Solution Using Private Endpoint

The infrastructure team deployed private endpoints for the Event Hubs namespace in the production server VNet and linked the correct private DNS zone through the hub. Test endpoints remained in a separate subscription with their own approval process. Network Watcher connection tests, CLI endpoint inspection, and Event Hubs metrics were added to the launch runbook. Public access was restricted only after canary servers proved they resolved the namespace to the private IP and delivered telemetry successfully. The deployment pipeline stored endpoint resource IDs and approval states for release traceability.

Results & Business Impact
  • Telemetry loss during launch stayed below 0.2% despite traffic spikes.
  • No emergency public firewall openings were required during the first 72 hours.
  • Production and test ingestion paths were clearly separated for operations staff.
  • Endpoint evidence reduced launch-readiness review meetings by 35%.
Key Takeaway for Glossary Readers

Private endpoints give high-pressure launch teams a controlled service access path that can be tested before traffic arrives.

Case study 03

City analytics team enables approved cross-subscription access

Scenario, objectives, solution, measured impact, and takeaway.

Scenario

A city government analytics team hosted permit and inspection data in Azure SQL, while a separate data science subscription needed controlled read access. The database owner did not want public firewall exceptions or broad network peering for every experiment.

Business/Technical Objectives
  • Allow a specific analytics subnet to reach the managed database privately.
  • Keep database ownership and connection approval with the service team.
  • Avoid broad VNet peering that exposed unrelated workloads.
  • Document access for public-sector data governance review.
Solution Using Private Endpoint

The database team created an approval workflow for private endpoint connection requests. The analytics team deployed a private endpoint in its own spoke subnet using the database resource ID and requested the sqlServer group ID. After approval, the platform DNS team linked the analytics VNet to the private DNS zone and verified the database hostname resolved to the endpoint IP. RBAC and database contained-user permissions remained separate from network access. CLI outputs for the endpoint, approval state, DNS link, and database firewall setting were attached to the governance ticket.

Results & Business Impact
  • The analytics subnet gained private database access without public firewall openings.
  • Approval ownership stayed with the database service team.
  • Network blast radius was limited to one subnet and one database target.
  • Governance evidence collection fell from manual screenshots to repeatable JSON exports.
Key Takeaway for Glossary Readers

Private endpoints help separate network reachability from data authorization while still giving service owners approval control.

Why use Azure CLI for this?

As an Azure engineer with ten years of network and platform operations, I use Azure CLI for private endpoints because endpoint health is spread across too many portal blades. CLI gives me the endpoint, NIC, connection state, group ID, DNS zone group, and target resource ID in one repeatable workflow. It is also the safest way to compare environments and prove drift before a change. When an app cannot reach a service, structured command output tells me whether I am dealing with DNS, rejected approval, wrong subresource, subnet placement, or service firewall policy. That habit shortens high-pressure network incidents. under pressure.

CLI use cases

  • List private endpoints in a resource group and identify which services, subresources, and subnets they connect to.
  • Show a private endpoint connection and verify approval state, group ID, target resource ID, and private IP address.
  • Create a private endpoint from infrastructure automation using the exact resource ID and target subresource required by the service.
  • Inspect DNS zone groups attached to an endpoint and confirm private DNS integration was configured during deployment.
  • Delete an endpoint only after exporting its target service, DNS records, NIC details, and dependent application owners.

Before you run CLI

  • Confirm tenant, subscription, resource group, VNet, subnet, target resource ID, target subresource, and private endpoint name.
  • Check Network Contributor permissions on the VNet side and appropriate permissions to create or approve the target service connection.
  • Verify region, subnet capacity, DNS zone design, public network access intent, and whether the change affects production traffic.
  • Treat create, delete, and approval commands as high-risk because they can immediately change how applications reach critical services.
  • Use JSON output for change evidence, and test DNS plus port connectivity from the real workload subnet before disabling public access.

What output tells you

  • privateLinkServiceConnections identifies the target resource, group ID, request message, and whether the connection is approved or pending.
  • ipConfigurations and networkInterfaces show the private IP and NIC that clients should reach after DNS resolves correctly.
  • provisioningState distinguishes a completed endpoint deployment from one that failed or is still being applied.
  • customDnsConfigs and DNS zone groups show whether Azure created private DNS integration or left name resolution for manual setup.
  • Resource IDs reveal the exact subscription, resource group, and service instance involved, which is essential in cross-team environments.

Mapped Azure CLI commands

Private endpoint commands

direct
az network private-endpoint list --resource-group <resource-group> --output table
az network private-endpointdiscoverAnalytics
az network private-endpoint show --resource-group <resource-group> --name <private-endpoint>
az network private-endpointdiscoverStorage
az network private-endpoint dns-zone-group list --resource-group <resource-group> --endpoint-name <private-endpoint>
az network private-endpoint dns-zone-groupdiscoverNetworking
az network private-endpoint create --name <private-endpoint> --resource-group <resource-group> --vnet-name <vnet> --subnet <subnet> --private-connection-resource-id <resource-id> --group-id <group-id> --connection-name <connection-name>
az network private-endpointsecureNetworking
az network private-endpoint delete --resource-group <resource-group> --name <private-endpoint>
az network private-endpointremoveNetworking

Architecture context

As an Azure architect, I treat a private endpoint as a network boundary decision tied to a consuming subnet and a specific service subresource. I do not add private endpoints everywhere by default. I first decide which clients need private access, whether the service supports the required subresource, how DNS will resolve, who approves connections, and whether public network access should be disabled. In a landing zone, private endpoints usually live in application spokes, while DNS zones and resolver rules are centrally governed. The architecture must document the source network, target service, approval flow, route assumptions, monitoring, and rollback path. Test early.

Security

Security impact is direct. A private endpoint gives a supported service a private IP inside a VNet, reducing public exposure when service firewall rules and public network access are also configured correctly. It does not replace authentication, authorization, encryption, or data-plane permissions. Attack surface still appears through mis-scoped RBAC, leaked keys, open public access, overly broad DNS links, or compromised workloads inside the network. Engineers should restrict who can create endpoints, approve private endpoint connections, change DNS zone groups, and modify target service networking. Security reviews should include NSGs, service firewall state, logs, private DNS, and identity permissions together. Continuously.

Cost

Cost impact is direct and indirect. Private endpoints and Private Link data processing can add charges, and every endpoint also creates operational ownership. Costs rise when teams create separate endpoints per app, per environment, per subresource, or per region without a design standard. However, private endpoints may reduce security risk, simplify audit scope, and avoid building heavier network appliances for service access. FinOps should track endpoint count, subresource count, data transfer, unused endpoints, duplicate private DNS zones, and whether public access remains enabled despite the spend. Governance tags and periodic cleanup reviews prevent hidden private connectivity sprawl. Review monthly. Remove them promptly.

Reliability

Reliability impact is direct because a private endpoint becomes part of the production access path. If its connection is rejected, the NIC is deleted, DNS resolves incorrectly, or the consuming subnet changes, applications can fail even while the target service is healthy. Private endpoints can reduce reliance on public network paths, but they introduce dependencies on DNS, subnet capacity, Private Link limits, and approval workflow. Reliable designs include tested DNS, clear ownership, deployment automation, health checks from the consuming network, and rollback steps. Operators should monitor connection state, DNS records, private IP changes, and service firewall settings after every change. First.

Performance

Performance impact depends on the workload. Private endpoints usually keep traffic on the Microsoft backbone and avoid public exposure, but they do not automatically make an application faster. DNS mistakes, resolver hops, cross-region access, service throttling, or a slow dependency can still dominate latency. The most important performance benefit is predictable routing from a known network to a known private IP. Operators should compare dependency latency, connection failures, DNS lookup time, and service metrics before and after migration. For high-volume systems, confirm Private Link limits, subnet capacity, client connection pooling, and whether the target service region matches the workload region. Under real load. That speeds accountable recovery.

Operations

Operators inspect private endpoints by checking connection state, target resource ID, group ID, private IP, subnet, DNS zone group, and service firewall configuration. During incidents, the fastest path is to test from the consuming workload: resolve the hostname, confirm the private IP, test port connectivity, and verify the service accepted the private connection. CLI is useful because portal views split details across networking, DNS, and the target service. Runbooks should cover approval, rejection, deletion, record cleanup, public access changes, and evidence collection for audits. Private endpoints should be deployed through infrastructure-as-code whenever possible. Document owners for DNS, service, and subnet changes. Document owner handoffs during service migration windows.

Common mistakes

  • Assuming private endpoint creation automatically disables the service public endpoint for every supported Azure service.
  • Selecting the wrong target subresource, such as blob instead of file, then wondering why clients cannot reach the intended service.
  • Forgetting private DNS integration, causing applications to continue resolving the public hostname instead of the private IP.
  • Deleting an endpoint without cleaning or validating DNS records, leaving clients pointed at stale private addresses.
  • Approving private endpoint connections without confirming the requester, source VNet, business purpose, and target data exposure.