Service Endpoints and Private Link

Azure Basics · Network Traffic – Routing, Private Link, Load Balancer, Application Gateway · Lesson 2 of 5

A service endpoint lets a subnet reach PaaS services over the backbone and lets the service lock itself to that subnet, but still uses the public endpoint; a private endpoint gives one resource a private IP in your VNet.

flowchart LR
  subgraph V["vnet-lab"]
    A["snet-app<br/>service endpoint Microsoft.Storage"]
    P["private endpoint pe-st<br/>10.10.2.10"]
  end
  A -- "backbone, to the public endpoint" --> S1["stdevopslab01.blob.core.windows.net"]
  P -- "Private Link" --> S2["stdevopslab01 (this resource only)"]

	Service endpoint	Private endpoint (Private Link)
Enabled on	A subnet (per service type, for example `Microsoft.Storage`)	A NIC with a private IP in a subnet for one resource
Service address	Still the service's public endpoint	A private IP in the VNet (needs a `privatelink.*` private DNS zone)
Usable from on-prem / peered VNets?	No (only the enabled subnet)	Yes, through VPN/ExpressRoute and peering
Data-exfiltration protection	Per service type	Only the mapped resource
Cost	Free	Paid per hour and data

Service endpoint: traffic goes over the Microsoft backbone with your private IP as source; then lock the service firewall to that subnet (az storage account network-rule add --vnet-name ... --subnet ...). Enabling an endpoint can take up to ~15 minutes.
Private endpoint: traffic stays entirely inside Microsoft's network, never on the Internet; it also works from on-premises.
Once enabled, the NIC's effective routes show routes with next hop VirtualNetworkServiceEndpoint.

Command	Meaning
`az network vnet subnet update ... --service-endpoints Microsoft.Storage`	Enable a service endpoint
`az network private-endpoint create ... --group-id blob`	Create a private endpoint for blob
`az network nic show-effective-route-table -g rg-devops-lab -n nic-app-01 -o table`	Show routes

How private endpoint DNS works

Clients keep using the normal name, such as stdevopslab01.blob.core.windows.net. Azure answers with a CNAME to stdevopslab01.privatelink.blob.core.windows.net; inside a VNet linked to the matching private DNS zone, that name resolves to the private IP, while outside it still resolves to the public address.

Service	Private DNS zone
Blob storage	`privatelink.blob.core.windows.net`
Azure SQL Database	`privatelink.database.windows.net`
Key Vault	`privatelink.vaultcore.azure.net`
Azure Container Registry	`privatelink.azurecr.io`

Test from a VM in the VNet with nslookup stdevopslab01.blob.core.windows.net: the answer should be a 10.x address. Getting a public IP means the zone is missing or not linked to that VNet. On-premises clients need conditional forwarding to Azure, usually through DNS Private Resolver.

Closing the public door

Creating a private endpoint does not by itself block the public endpoint. Set public network access to Disabled on the resource (for storage, az storage account update --public-network-access Disabled) once private access works. A private endpoint connection can require approval by the resource owner, which matters when the endpoint is in another team's subscription.

Service endpoint policies

A service endpoint policy restricts a subnet's service endpoint traffic to specific storage accounts, closing the gap that a plain endpoint allows any storage account in Azure.

Private Link service

You can also publish your own application behind a Standard internal load balancer as a Private Link service, so customers or other teams reach it through a private endpoint in their own VNet, with no peering and no overlapping address concerns.