L8. Private Endpoints & Service Endpoints
Course outlineLesson 8 of 18
Private Endpoints and Service Endpoints both restrict Azure PaaS access to your VNet, but they work completely differently. The AZ-500 exam tests which to use when, and Private DNS Zone configuration is a favourite question topic.
Service Endpoints vs Private Endpoints
| Feature | Service Endpoints | Private Endpoints |
|---|---|---|
| Traffic path | Stays on Azure backbone, exits via public IP | Private IP in your VNet: never uses public IP |
| DNS | Service resolves to public FQDN | Service resolves to private IP via Private DNS Zone |
| Cost | Free | Charged per endpoint plus data processing |
| Access from on-premises | No (VNet only) | Yes (via ExpressRoute/VPN) |
Private Endpoint Architecture
A Private Endpoint creates a NIC in your subnet with a private IP. Azure maps the service's public FQDN to this private IP via a Private DNS Zone.
Required setup:
- Create the Private Endpoint (NIC is injected into your subnet)
- Create a Private DNS Zone (for example, privatelink.blob.core.windows.net for Storage)
- Link the Private DNS Zone to your VNet
- Add an A record: storage-account-name to private IP
When to Use Which
Use Service Endpoints when:
- You only need VNet-to-service traffic (on-premises is not a requirement)
- Cost is a concern
- The service is in the same region
Use Private Endpoints when:
- On-premises systems need to reach the service
- You need the service to be completely removed from the public internet
- Regulatory requirements mandate private-only connectivity
Exam Trap: Disabling Public Access
Setting a Storage Account to "Disable public network access" means ALL traffic including from trusted VNets via Service Endpoints is blocked. Only Private Endpoint traffic bypasses this restriction.
- ✓Private Endpoint = private IP in your VNet via NIC injection. Service Endpoint = backbone routing, still public IP
- ✓Private Endpoint requires Private DNS Zone plus VNet link: without DNS config, traffic hits the public IP
- ✓Service Endpoints do not work from on-premises. Private Endpoints do (via ExpressRoute or VPN)
- ✓"Disable public network access" on a storage account blocks Service Endpoint traffic: only Private Endpoint bypasses this
- ✓Private DNS Zone name convention: privatelink.<service>.core.windows.net (blob, queue, file, etc.)
1. A storage account is protected by a Private Endpoint. A VM in the same VNet tries to resolve 'mystorageaccount.blob.core.windows.net'. What IP address is returned?
2. What is the key difference between a Service Endpoint and a Private Endpoint?
3. Which DNS zone is required to support Private Endpoints for Azure Blob Storage?
Recommended: Pluralsight
This free course covers the theory. Pluralsight adds structured video courses, hands-on Azure labs, and timed practice exams to make it stick before exam day.