Azure capability placing PaaS services such as Azure Storage behind a private endpoint in your VNet. Traffic stays on the Microsoft backbone with no public IP involved, though VNet and DNS configuration are required.
Also called Private Link.
Read more: Microsoft Learn
In the Ultra Transcenders books
AZ-104AZ-700SC-500AI-300AI-103AZ-900
Each book explains Azure Private Link in context, with comparison tables and the common traps.
Terms in this definition
- Capability
Something that a person, organisation or system is able to do.
- PaaS
Platform as a service, managed offerings such as Azure SQL Database and App Service in which the provider looks after the infrastructure and operating system.
- Azure Storage
You reach this Azure data storage platform through a storage account; it covers blobs (Data Lake Storage included), file shares, queues and tables.
- Private endpoint
A network interface in your subnet whose private IP leads, through Private Link, to a single instance of a service. Peered VNets and on-premises networks (via ExpressRoute or VPN) can use it, after which public access can be switched off.
- VNet
A private network belonging to a single subscription and region and covering all of that region's availability zones. A VM can only use a VNet located in the same region.
- DNS
The system that turns names into addresses. In Azure, private endpoints depend on private DNS zones, which are queried through 168.63.129.16.
Related terms
- Azure ExpressRoute
A private link, arranged with a connectivity provider, between an on-premises network and Microsoft's cloud that avoids the public internet. Compared with a VPN it offers better reliability, higher speeds and steadier latency.
- ExpressRoute
A dedicated private link between on-premises networks and Azure, using Microsoft peering or private peering.
- Front Door (classic)
The first-generation Azure Front Door tier, built around frontend hosts, backend pools and routing rules. It cannot use Private Link origins or accept new domains, and it retires on 31 March 2027.
- Front Door Premium
The Azure Front Door tier that builds on Standard by adding bot protection, managed WAF rule sets and Private Link origins.
- Front Door Standard
Lower Azure Front Door tier, with support for routes, custom domains, rule sets and your own WAF rules. Managed WAF rule sets and Private Link origins are only available after upgrading to Premium.