Skip to content

5️⃣ Private Endpoint

🔹 Definition

Image

Private Endpoint gives Azure services a private IP inside your VNet.

  • No public endpoint
  • Zero exposure to internet
  • Used with Azure PaaS services

When to use

  • Azure SQL
  • Storage Account
  • Key Vault

🔧 Azure CLI

az network private-endpoint create \
  --resource-group rg-vnet-demo \
  --name pe-sql \
  --vnet-name vnet-main \
  --subnet subnet-private \
  --private-connection-resource-id <SQL_RESOURCE_ID> \
  --group-id sqlServer

🖥️ Azure Portal Flow

Portal → Service (SQL/Storage)
→ Networking → Private Endpoint
→ Select VNet & Subnet
→ Approve Connection

📦 Example

App → Private IP → Azure SQL
Internet ❌→ Azure SQL

✔ Maximum security ✔ Compliance-ready

🧠 Quick Comparison (Interview Gold)

Service Inbound Outbound Use Case
NAT Gateway ❌ ✅ Private subnet internet
Firewall ✅ ✅ Enterprise security
Bastion Admin only ❌ Secure VM access
Peering ✅ ✅ VNet connectivity
Private Endpoint ❌ Internal only Secure PaaS access

🎯 Architecture Rule of Thumb

Public access → Firewall
Outbound only → NAT Gateway
Admin access → Bastion
VNet ↔ VNet → Peering
PaaS security → Private Endpoint