Implement and manage virtual networking
Service Endpoints and Private Endpoints
CoreChoose service or private endpoints from private-IP, source identity, DNS, and public-access requirements.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Both endpoint types can restrict PaaS access from a VNet, but only one places a private interface for a specific resource inside the VNet and therefore changes DNS and path design.
Must Know
- A service endpoint extends a subnet’s identity to a supported Azure service while clients still use the service’s public endpoint.
- A private endpoint is a network interface with a private IP in a subnet that connects through Private Link to a specific service resource or subresource.
- Private endpoint clients normally need the standard service hostname to resolve to the private IP through appropriate private DNS.
- Creating a private endpoint does not by itself disable the target resource’s public network access.
- The target service must approve or accept the private endpoint connection according to its connection workflow.
Compare and Distinguish
- Service endpoint vs private endpoint: subnet identity on a public service endpoint vs private IP access to one service resource.
- Storage firewall vs endpoint: account-side admission rule vs network path or subnet identity used to reach the account.
- Private endpoint vs VNet peering: private interface to a PaaS resource vs private routing between whole VNet address spaces.
Scenario examples
- Scenario: A storage account can retain its public endpoint but should accept traffic from one application subnet. Think: Enable the service endpoint and authorize that subnet in storage network rules.
- Scenario: A database must be reached only through a private VNet address. Think: Create a private endpoint, configure private DNS, approve the connection, and restrict public access.
- Scenario: The private endpoint is approved but clients still resolve the service to a public address. Think: Correct the private DNS zone record and VNet link.
Exam traps
- A service endpoint keeps the PaaS service on its public endpoint and does not allocate a private endpoint NIC.
- Private Link connectivity can exist while public access remains enabled unless the service is configured otherwise.
- An approved private endpoint with incorrect DNS can appear unreachable even when routing is ready.
Key takeaways
- Use a private endpoint when the requirement explicitly demands a private IP for one PaaS resource.
- Treat endpoint creation, target-service authorization, public-access posture, and DNS as separate configuration steps.
How it works
- Service-endpoint traffic uses an optimized Azure backbone route while the service evaluates the source VNet or subnet identity.
- Private Link maps the private endpoint NIC to the target service, and DNS directs clients to that NIC address.
Objects and administrative surfaces
- Subnet — enable a supported service endpoint or allocate the private endpoint NIC address.
- PaaS resource — firewall or selected-network rules, private endpoint connection approval, subresource selection, and public network access.
- Private DNS zone and VNet link — standard service name resolution to the private endpoint address.
When to use it
- Use a service endpoint for simple subnet-restricted access when a public service endpoint is acceptable.
- Use a private endpoint for private addressing, on-premises private reach, or exfiltration-resistant resource targeting.
Security and governance implications
- Disable or restrict public network access when the requirement is private-only and monitor private connection approvals.
- Control private DNS records centrally to prevent silent redirection or accidental public resolution.
How to reason about this
- Resolve the service name from the client, verify its IP and route, inspect endpoint connection state, subnet controls, and target resource firewall.
- For service endpoints, confirm endpoint enablement on the actual source subnet and that the service network rule names that subnet.
More detail
- Configure service endpoints on subnets and corresponding network rules on supported PaaS resources.
- Configure private endpoints, select the correct subresource, approve connections, link private DNS, and set public access deliberately.
Ready for the quiz?
- Which endpoint type continues to use the service public endpoint?
- Why does a private endpoint usually require private DNS integration?
- What must be changed if public access must also be prohibited?
Related objectives
- D4.2.S4 — Configure service endpoints for Azure platform as a service (PaaS)
- D4.2.S5 — Configure private endpoints for Azure PaaS