Lab: diagnose private Azure networking

Outcome

Compare a service endpoint with a private endpoint for training Storage accounts. Verify their different DNS, public-network, firewall, and reachability behavior, then diagnose DNS and NSG failures with Network Watcher tools.

Do

1. Create a training VNet with workload and private-endpoint subnets, plus a small supported test workload.
2. Create a first Storage account with public network access enabled for selected networks. Enable the Storage service endpoint on the workload subnet and allow that subnet in the storage firewall. Verify that the workload can access the account while the service name still resolves to its public endpoint.
3. Create a second Storage account with public network access disabled and a private endpoint for Blob Storage.
4. Create/link the required private DNS zone. From the workload, verify that the private-storage hostname resolves to a private IP and that the expected operation succeeds.
5. Create a Connection Monitor or use relevant Network Watcher diagnostics to record each path and expected port/protocol.
6. Inspect the workload NIC’s effective NSG rules and routes.

Verify

Capture public DNS resolution for the service-endpoint account, private DNS resolution and endpoint state for the private-endpoint account, effective rules, route evidence, and a successful operation to each. Explain why a service endpoint keeps a PaaS public endpoint while a private endpoint creates a private address, and why DNS, NSGs, routes, and resource firewall settings can independently break a path.

Break and fix

1. Remove the private-DNS-zone VNet link. Confirm incorrect resolution/failure, then restore it.
2. Remove the service-endpoint subnet rule from the first Storage account. Confirm that the workload loses access even though public DNS resolution remains unchanged, then restore the rule.
3. Add a safe, temporary NSG deny that blocks the tested flow. Observe the effective rule/IP Flow Verify result, then remove it.
4. Disable the test endpoint/connection-monitor configuration and explain why a historic pass does not prove current connectivity; restore monitoring.

Scenario practice

1. Configure: Select a service endpoint or private endpoint for a storage workload that must keep public network access disabled, and justify the DNS design.
2. Diagnose: A workload resolves a storage name publicly but receives a firewall denial. Which DNS, route, NSG, and storage-firewall observations narrow the cause?
3. Distinguish: Contrast a service endpoint, private endpoint, private DNS zone, and NSG; identify which one changes the endpoint address.

Clean up

Delete the test endpoint, service-endpoint configuration, DNS records/zones if dedicated, monitors, NSG test rule, workload, both Storage accounts, and training resource group.

Sources and re-audit

• Azure Private Endpoint DNS integration, service endpoints, and Network Watcher, checked 2026-08-22.

Re-audit when Private Link DNS, service-endpoint support, Storage firewall behavior, or Network Watcher diagnostics change.

Related

service-endpoint · private-endpoint · private-dns · effective-nsg-rules · connection-monitor · All labs