Private endpoint DNS: how privatelink zones resolve a service to its private IP

A private endpoint is only useful if clients resolve the resource’s normal name to the private IP. Azure does this with privatelink private DNS zones and a CNAME from the public name.

• The endpoint registers an A record in the privatelink zone linked to the VNet, e.g. <account>.privatelink.blob.core.windows.net or myapp.privatelink.azurewebsites.net, pointing at the private IP.
• The public name (myapp.azurewebsites.net) becomes a CNAME to the privatelink name, so clients in linked VNets resolve the private IP. Figure 12.1 shows the same lookup chain for a storage account.
• Records are never created in a public Azure DNS zone or in your custom zones; <tenant>.onmicrosoft.com is the Microsoft Entra tenant’s initial domain, not an App Service name.
• Don’t create a private zone named azurewebsites.net: it would override public resolution for every web app.
• Custom private name: add a CNAME in the custom private zone (www.private.example.com → mywebapp.privatelink.azurewebsites.net) and add the custom domain to the web app so it accepts the host name.

Common trap: Relying on a private endpoint alone plus a CNAME to an onmicrosoft.com name for a custom private URL - the endpoint alone doesn’t make the custom URL resolve; add a CNAME to the privatelink name and bind the custom domain to the app.

Get the whole book

This note is one section of Ultra Transcenders AZ-700: Designing and Implementing Microsoft Azure Networking Solutions, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · Free AZ-700 glossary · All AZ-700 study notes