Virtual Network Service Endpoint
What it is
A virtual network service endpoint extends a subnet’s identity to a supported Azure PaaS service. The service can then allow that subnet in its network rules. Traffic takes an optimized route on the Azure backbone, while the service keeps its public endpoint and public DNS name.
Why it exists
It gives a simple way to limit a PaaS public endpoint to selected subnets without putting a private network interface for the service into each VNet.
Key ideas
- Enable the endpoint on the client subnet, then allow that VNet/subnet in the PaaS resource’s network rules. Both steps matter.
- The service name still resolves to a public service address. “Public endpoint” does not mean traffic from the enabled subnet crosses the public internet.
- Service endpoints are service-specific and subnet-based. They cannot carry traffic from on-premises systems to Azure services through the endpoint.
- Enabling one changes the source identity that the service sees from an Azure public address to the subnet’s private address. Existing IP-firewall rules and open connections can be affected during the change.
- Microsoft recommends Private Link / Private Endpoints where private, service-specific network interfaces are the required design.
Northwind example
Northwind enables the Microsoft.Storage service endpoint on snet-orders, then adds that subnet to the ordering storage account’s virtual-network rules. The ordering VMs can reach the storage public endpoint by an optimized Azure path; a VM in snet-reporting cannot unless it receives its own allowed network rule. The storage request still needs a valid Entra identity, SAS, or key—network access alone does not read data.
Service endpoint versus Private Endpoint
| Need | Better fit |
|---|---|
| Allow selected subnets to a supported service’s public endpoint | Service endpoint plus service network rule |
| Give the service a private IP in your VNet and use private DNS | [[private-endpoint |
| Connect an on-premises client through a private address | Private Endpoint with a designed network and DNS path |
Related
private-endpoint · storage-network-rule · subnet
📘 Source: Microsoft Learn — Azure virtual network service endpoints