Introduction

• What a Service Endpoint is and how it works
• How to add Service Endpoints to a subnet

​

What is a Service Endpoint?

• Uses the Azure backbone for traffic between your VNet and supported Azure services.
• Lets you configure service-level firewall rules to allow traffic only from selected subnets.
• Is configured per-subnet and per-service type (for example, Microsoft.Storage).

​

Why use Service Endpoints?

• Improved security: traffic does not leave the Microsoft network.
• Access control: restrict Azure service access to specific subnets or VNets.
• Simplicity: minimal changes to application code; works with existing public endpoints but enforces subnet-based access control.
• Lower latency and improved reliability compared to internet paths.

​

Supported services (examples)

​

How to add a Service Endpoint to a subnet

• Azure CLI

# Add Microsoft.Storage service endpoint to a subnet
az network vnet subnet update \
  --resource-group MyResourceGroup \
  --vnet-name MyVnet \
  --name MySubnet \
  --service-endpoints Microsoft.Storage

• Azure PowerShell

# Example: add Microsoft.Storage to a subnet (assumes $vnet is fetched)
Set-AzVirtualNetworkSubnetConfig `
  -VirtualNetwork $vnet `
  -Name "MySubnet" `
  -AddressPrefix "10.0.1.0/24" `
  -ServiceEndpoints @{Service="Microsoft.Storage"}
# Then update the VNet
Set-AzVirtualNetwork -VirtualNetwork $vnet

• ARM template snippet (enable storage service endpoint on a subnet)

{
  "name": "myVnet",
  "type": "Microsoft.Network/virtualNetworks",
  "apiVersion": "2020-06-01",
  "properties": {
    "subnets": [
      {
        "name": "MySubnet",
        "properties": {
          "addressPrefix": "10.0.1.0/24",
          "serviceEndpoints": [
            {
              "service": "Microsoft.Storage"
            }
          ]
        }
      }
    ]
  }
}

​

Post-configuration steps

1. On the target Azure service (for example, a storage account), set the network/firewall rules to allow access from the VNet/subnet. For Storage Accounts, add the VNet/subnet under the “Firewalls and virtual networks” settings.
2. Validate connectivity from a VM or resource within the subnet to the service endpoint.
3. Monitor traffic and logs to confirm traffic is flowing over the Azure backbone.

​

Quick comparison: Service Endpoint vs Private Endpoint

​

References

• Azure Virtual Network service endpoints overview
• Configure service endpoints for Azure Storage
• Azure Private Endpoint vs Service Endpoint