Azure Private Link Overview

Why public PaaS endpoints are a problem

Azure Storage, Azure SQL, Cosmos DB, and other PaaS services have public endpoints by default. The URL for your storage account — mystorageaccount.blob.core.windows.net — resolves to a public IP address accessible from anywhere on the internet.

You can restrict access using storage account firewalls and service endpoints, but the public endpoint still exists. A misconfigured firewall rule, a new service principal with broad permissions, or a zero-day vulnerability in the service exposes data that should be private.

Private Link eliminates the public endpoint problem. The service gets a private IP in your VNet. You configure the storage account to deny all public access. Now the service is only reachable from within your VNet (or connected VNets and on-premises networks).

How Private Link works

Private Link has two sides: the provider side and the consumer side.

Provider side: An Azure PaaS service (or your own service) registers with the Private Link service. Azure manages this for first-party services like Storage and SQL automatically.

Consumer side: You create a Private Endpoint in your VNet. The private endpoint is a network interface with a private IP from your subnet. It connects to the Private Link service of the target PaaS resource.

When your application calls mystorageaccount.blob.core.windows.net, DNS resolves to the private IP of the endpoint in your VNet. Traffic flows through the private endpoint to the storage service entirely within the Azure backbone — no public internet, no public IP.

Traffic flow with Private Link

Here is the path a request takes when using a private endpoint, compared to the default public path:

Without Private Link:

App VM (10.0.2.10) → Azure VNet → Internet edge → Public IP of storage account → Storage service

With Private Link:

App VM (10.0.2.10) → Private endpoint NIC (10.0.3.5) → Private Link → Storage service backend

The private endpoint NIC is in your subnet. The storage service is connected to it through Private Link. Traffic never leaves Microsoft’s network infrastructure.

Creating a private endpoint with the CLI

Create a private endpoint for an Azure Storage account:

# Create a subnet for private endpoints
az network vnet subnet create \
  --name snet-privateendpoints \
  --resource-group rg-prod-networking \
  --vnet-name vnet-prod-eastus-001 \
  --address-prefixes 10.0.5.0/24

# Get the storage account resource ID
STORAGE_ID=$(az storage account show \
  --name mystorageaccountprod \
  --resource-group rg-prod-storage \
  --query id \
  --output tsv)

# Create the private endpoint
az network private-endpoint create \
  --name pe-storage-blob \
  --resource-group rg-prod-networking \
  --vnet-name vnet-prod-eastus-001 \
  --subnet snet-privateendpoints \
  --private-connection-resource-id $STORAGE_ID \
  --group-id blob \
  --connection-name conn-storage-blob

The —group-id specifies which sub-resource to connect to. For Storage: blob, file, queue, table, dfs. For SQL: sqlServer. For Key Vault: vault. Each sub-resource gets its own private endpoint.

Disable public access on the storage account after the private endpoint is working:

az storage account update \
  --name mystorageaccountprod \
  --resource-group rg-prod-storage \
  --public-network-access Disabled

DNS configuration — the critical step

Creating the private endpoint is not enough. Your application’s DNS must resolve the storage account hostname to the private IP, not the public IP. If DNS still returns the public IP, traffic bypasses the private endpoint.

Azure Private DNS zones handle this automatically when integrated with your VNet. Create a private DNS zone for the storage blob endpoint:

# Create the private DNS zone for blob storage
az network private-dns zone create \
  --name privatelink.blob.core.windows.net \
  --resource-group rg-prod-networking

# Link the DNS zone to your VNet
az network private-dns link vnet create \
  --name link-vnet-prod \
  --resource-group rg-prod-networking \
  --zone-name privatelink.blob.core.windows.net \
  --virtual-network vnet-prod-eastus-001 \
  --registration-enabled false

# Create a DNS zone group on the private endpoint
# This automatically creates the DNS record when the endpoint is provisioned
az network private-endpoint dns-zone-group create \
  --endpoint-name pe-storage-blob \
  --resource-group rg-prod-networking \
  --name dzg-storage-blob \
  --private-dns-zone privatelink.blob.core.windows.net \
  --zone-name privatelink.blob.core.windows.net

Verify that DNS resolution returns the private IP:

# From a VM inside the VNet, verify the hostname resolves to the private IP
nslookup mystorageaccountprod.blob.core.windows.net
# Should return 10.0.5.x, not a public IP like 52.x.x.x