When a PaaS resource must be reachable on a private address, service endpoints aren’t enough; you need a private endpoint.
A private endpoint (Azure Private Link) gives a PaaS resource such as a storage account a private IP in your VNet, so VM traffic to it stays on the Microsoft backbone. It is the only option that gives a private IP.
Private endpoints give access to specific PaaS resources; they don’t connect networks.
Azure Peering Service optimises routing between an ISP and Microsoft; it has nothing to do with private PaaS access.
| Option | Private IP in your VNet? | Scope |
|---|---|---|
| Service endpoint | No (public endpoint over the Azure backbone) | Whole service type from a subnet (for example all storage accounts) |
| Service endpoint policy | No | Limits a Microsoft.Storage endpoint to listed storage accounts |
| Private endpoint | Yes | One specific PaaS resource |
Clients find the private IP through DNS: the private endpoint’s A record is kept in a private DNS zone such as privatelink.blob.core.windows.net (for Blob storage), and that zone must be linked to the VNet so that the storage account’s usual name resolves to the private IP. (See Figure 12.2.)
