Skip to main content
Azure Private Endpoint (Private Link) provides truly private connectivity to Azure PaaS services by assigning a private IP from your virtual network to the target resource. This keeps traffic on the Azure backbone and avoids reliance on public endpoints — a common requirement for strict security policies.

​
Service Endpoints vs Private Endpoints (at a glance)

Benefits of Azure Private Endpoint:
  • Private connectivity to Azure services: PaaS resources receive a private IP from your VNet.
  • Seamless integration with on-premises and peered networks: on-prem clients can resolve and reach the PaaS resource over VPN/ExpressRoute once DNS is configured correctly.
  • Reduced risk of data exfiltration: traffic stays on private networks unless an internal agent or misconfiguration allows exfiltration.
  • Direct availability in Azure virtual networks: the resource is reachable like any other private resource without extra NAT or public Internet exposure.
In this lesson we will deploy and validate a Private Endpoint for a storage account.

​
Scenario setup and verification

If you previously tested Service Endpoints, you can reuse that infrastructure. To simulate a scenario where only private access should work, disable public network access on the storage account. After disabling public access, attempts to use the public endpoint from a VM should fail with an AuthorizationFailure:
That AuthorizationFailure indicates the VM cannot access the storage account via the public endpoint. Next, create a Private Endpoint so the VM can reach the storage account privately.

​
Creating a Private Endpoint (storage account)

When creating a Private Endpoint in the portal, choose:
  • Name (example: PE-Storage)
  • Target resource type (Storage) and subresource (Blob)
  • Virtual network and subnet where the private IP will be allocated
The Private Endpoint creates a network interface in the selected VNet/subnet and assigns a private IP. Traffic from resources in the VNet to the storage account will be routed to that private IP.
Screenshot of the Microsoft Azure portal showing the "Create a private endpoint" wizard on the Basics tab. It displays project details (subscription and resource group) and instance details (name, network interface name, region).
When selecting the virtual network, the Private Endpoint can be placed in any subnet that makes sense for your network design. It does not need to be in the same subnet as the VM; it can be in a peered VNet or another connected network (peering, VPN, ExpressRoute). For this demo, the endpoint is placed in the same subnet as the VM for simplicity.
Screenshot of the Microsoft Azure portal on the "Create a private endpoint" wizard (Virtual Network step). It shows vnet-01 selected, subnet set to "default," and the private IP configuration set to dynamically allocate.

​
Private DNS integration

Private Endpoints work with Azure Private DNS Zones. During creation, the portal can create a zone such as privatelink.blob.core.windows.net and add the A record that maps the storage account name to the private IP address. Any VNet that needs to resolve the private name must be linked to that Private DNS Zone. If your VMs use Azure-provided DNS, linking the VNet is sufficient. If you use custom DNS or need on-premises resolution, additional DNS forwarding is required.
  • On-premises resolution typically requires configuring a conditional forwarder on your on-premises DNS server for privatelink.blob.core.windows.net, forwarding queries to an Azure-based DNS resolver or Private Resolver. That Azure resolver should forward to Azure’s recursive DNS IP (168.63.129.16) when needed so names resolve to the private IP assigned to the Private Endpoint.
Screenshot of the Microsoft Azure portal on the "Create a private endpoint" page at the DNS step, showing Private DNS integration options and fields for subscription, resource group and private DNS zone. Navigation buttons ("Previous" and "Next: Tags") are visible at the bottom.
Create the Private Endpoint and wait for the deployment to complete. After deployment, open the Private Endpoint resource. The object you created is the Private Endpoint; the resource on the other side is the Private Link Resource. The portal displays the associated network interface, the target subresource (blob), and the connection status.
A screenshot of the Microsoft Azure portal showing the "pe-st" private endpoint Overview page with Essentials (resource group, East US location, subscription ID and provisioning state). It also lists network details like virtual network/subnet, network interface, private link resource, target sub-resource "blob", and connection status "Approved."

​
Verify DNS resolution and access

From the VM, verify that the storage account hostname CNAMEs to the privatelink name and resolves to the private IP allocated by the Private Endpoint:
Now access the blob over the private connection. Downloading the file should succeed because traffic is routed to the storage account via the Private Endpoint’s private IP:
If you need on-premises clients to resolve Private Link names, configure a conditional forwarder on your on-premises DNS to an Azure-based DNS server or Private Resolver. That Azure resolver should forward the privatelink.* queries to Azure’s recursive DNS (168.63.129.16) so they return the private IP. Also ensure your Azure Private DNS zone is linked to the VNets that need resolution.

​
Summary

  • Private Endpoints assign a private IP from your VNet to a PaaS resource by creating a network interface, making the resource addressable privately.
  • Ensure Private DNS zones are created and VNets linked (or configure conditional forwarders for on-premises) so names resolve to the private IP.
  • After creating a Private Endpoint and verifying DNS resolution, clients in linked VNets (and correctly configured on-premises networks) can access the service entirely over private connectivity.
With that, the Private Endpoint demonstration is complete and the Administer intersite connectivity module is finished.

Watch Video