Private access
CoreVirtual Network service endpoints
VNet identity on service public endpoints over the Azure backbone.
Key points
- Extend subnet identity to supported Azure services.
- Traffic uses the Azure backbone but addresses the service public endpoint.
- The target service must allow the selected VNet or subnet.
Best-known use cases
- Restrict a storage public endpoint to one subnet.
- Secure supported PaaS access without creating private endpoint NICs.
What candidates often confuse it with
- Service endpoint vs private endpoint: public service address with subnet identity vs private address for one resource.
- Service endpoint vs firewall rule: source identity path vs target-side admission setting.
Key takeaway
Use a service endpoint when subnet-restricted access is required and retaining the PaaS public endpoint is acceptable.
Related services
- Azure Private Link and private endpoints
Relevant exam tasks
- D4.2.S4 — Configure service endpoints for Azure platform as a service (PaaS)
- D4.2.S5 — Configure private endpoints for Azure PaaS