2.4.5. Network Security: Managed Private Endpoints

💡 First Principle: Network security extends beyond data-level controls to network-level isolation. Think of Managed Private Endpoints as private tunnels through Microsoft's backbone network—traffic never touches the public internet, eliminating exposure to internet-based attacks. Without this, your "secured" data might travel over public infrastructure.

Scenario: Your organization's Azure SQL Database contains sensitive financial data and is configured to deny public network access. Your Fabric workspace needs to connect to this database for ETL pipelines. Without network-level configuration, the connection will fail.

Understanding Managed Private Endpoints

• Concept: Private network connections from Fabric to Azure services using Azure Private Link
• Benefit: Traffic flows over Microsoft's backbone network, never traversing public internet
• Requirement: The target Azure service must support Private Link
• Direction: Outbound only (Fabric → your Azure resource). Inbound private access (users → Fabric) is a different feature: tenant- or workspace-level private links, which can block public internet access to Fabric. To force outbound traffic through MPEs, enable workspace outbound access protection. It blocks all outbound connections except MPEs and approved data connection rules
• Supported workloads: Data Engineering items (notebooks, Spark job definitions, lakehouses) and Eventstream. Pipelines and Dataflow Gen2 don't use MPEs. They reach network-isolated sources through trusted workspace access (storage) or a virtual network or on-premises data gateway
• Versus IP allowlisting: Fabric's IP ranges and service tags are shared by every tenant, and the traffic still crosses the public endpoint. An MPE is a private connection dedicated to your workspace and the target resource

Managed Private Endpoint Configuration

Creating a Managed Private Endpoint

1. Navigate to Workspace Settings → Network Security
2. Select Create Managed Private Endpoint
3. Specify the target Azure resource and its target sub-resource (e.g., sqlServer for Azure SQL Database, dfs or blob for a storage account)
4. Submit request—target resource owner must approve
5. Once approved, notebooks and Spark job definitions use the endpoint automatically: connect with the resource's normal host name

Visual: Managed Private Endpoint Flow

Trusted Workspace Access

• Concept: Allow Fabric workspaces to access Azure Storage accounts configured with firewall rules
• Benefit: Storage account remains protected by firewall while permitting specific Fabric workspace access
• Implementation: Configure on the Azure Storage Account firewall settings

Trusted Workspace Access Configuration:

1. Navigate to Azure Storage Account → Networking → Firewalls and virtual networks
2. Enable Allow trusted Azure services to access this storage account
3. Add Fabric workspace identity to Resource instances exceptions
4. Fabric can now access storage despite firewall rules

When to Use Each Approach

⚠️ Exam Trap: Creating a Managed Private Endpoint doesn't provide immediate connectivity. The endpoint requires approval by the target resource owner. Until approved, connections will fail. Questions about "connection timeout after creating endpoint" are testing this knowledge.

💡 Exam Tip: Questions about connecting Fabric to resources with "public access disabled" or "firewall enabled" typically require Managed Private Endpoints or Trusted Workspace Access—not service principals alone.

Reflection Question: Your Azure SQL Database has public network access disabled. A data engineer creates a connection in Dataflow Gen2 but receives a connection timeout error. What is the most likely cause and solution?