Azure Private Endpoint
What it is
A private endpoint is a network interface with a private IP address from your VNet. It gives clients in that network a private path to a supported Azure service or Private Link service. In plain language, it places a private “door” to a specific service instance inside your network; it does not move the entire service into your subnet.
Why it exists
It lets a workload reach a PaaS service such as Storage or Key Vault through a private address rather than the service’s public endpoint. This reduces public exposure and gives the destination a VNet-local path.
Key ideas
- The endpoint uses a private IP from a subnet. The target remains a separate Azure service resource; clients initiate connections to the endpoint.
- DNS is essential. Clients must resolve the target service name to the private endpoint’s IP, commonly using a private DNS zone. A private endpoint with incorrect DNS often looks like a connectivity failure.
- Connection approval can be automatic or manual, depending on permissions and the target. Only an approved connection can carry traffic.
- After testing private connectivity, a service can often disable public network access where its supported configuration allows it. This is a deliberate target-service decision, not an automatic effect of creating the endpoint.
Northwind example
Northwind gives its ordering app private access to one production storage account through a private endpoint in the private-endpoints subnet. Private DNS makes the usual storage hostname resolve to the endpoint’s private address for Northwind’s network. The app still uses its managed identity and data permissions to read the receipt—it has a private network path, not automatic data authorization. Once the path is tested, Northwind disables the storage account’s public access according to its requirements.
Private Endpoint versus service endpoint
| Need | Prefer | Why |
|---|---|---|
| A private IP in your VNet for one supported service instance | Private Endpoint | Private Link creates the private network interface. |
| Secure a supported Azure service to traffic identified as coming from a VNet | [[service-endpoint | Service endpoint]] |
| Control source or destination traffic at addresses and ports | [[nsg | NSG]] |
Common confusion
- A private endpoint is not a VPN, a public IP, or a generic outbound proxy.
- Private networking does not grant a caller access to the service data. Identity and authorization still apply.
- A private endpoint is scoped to its target connection; it is not a blanket “make all Azure services private” switch.
Diagnose in order
Confirm the endpoint connection is approved, DNS resolves to the expected private address, a client has a route to it, network controls permit traffic, and the service permits the request. Then check the caller’s data-plane authorization.
Related
service-endpoint · private-dns · storage-network-rule · vnet · subnet · nsg · managed-identity · northwind-traders-case-study
Source: Microsoft Learn — What is a private endpoint?, checked 2026-09-16.