Private Endpoints & Service Endpoints: AZ-500 Deep Dive

Service Endpoints vs Private Endpoints

Private Endpoint Architecture

A Private Endpoint creates a NIC in your subnet with a private IP. Azure maps the service's public FQDN to this private IP via a Private DNS Zone.

Required setup:

1. Create the Private Endpoint (NIC is injected into your subnet)
2. Create a Private DNS Zone (for example, privatelink.blob.core.windows.net for Storage)
3. Link the Private DNS Zone to your VNet
4. Add an A record: storage-account-name to private IP

Exam tip: Without the Private DNS Zone, clients resolve the storage FQDN to the public IP and bypass the private endpoint entirely: even if the storage firewall denies public access.

When to Use Which

Use Service Endpoints when:

• You only need VNet-to-service traffic (on-premises is not a requirement)
• Cost is a concern
• The service is in the same region

Use Private Endpoints when:

• On-premises systems need to reach the service
• You need the service to be completely removed from the public internet
• Regulatory requirements mandate private-only connectivity

Exam Trap: Disabling Public Access

Setting a Storage Account to "Disable public network access" means ALL traffic including from trusted VNets via Service Endpoints is blocked. Only Private Endpoint traffic bypasses this restriction.