3.3.4. Private Endpoints and Azure Private Link
💡 First Principle: A PaaS resource with a public endpoint is reachable from the internet by definition, no matter how tightly its firewall rules are configured — a Private Endpoint removes that public reachability entirely by giving the resource a private IP address inside your own VNet.
Azure Private Link is the underlying service that enables private, VNet-based connectivity to Azure PaaS resources (Storage, Key Vault, SQL, and others) and to your own Private Link services. A Private Endpoint is the specific network interface, provisioned inside your VNet with a private IP, that represents the connection to a given PaaS resource — traffic from your VNet to that resource never traverses the public internet. This differs meaningfully from service endpoints (introduced conceptually in 3.1's misconception callout), which extend your VNet's identity to the resource but leave its public IP intact.
⚠️ Exam Trap: Configuring a Private Endpoint for a storage account doesn't automatically block the account's existing public endpoint — you typically also need to explicitly disable public network access on the resource itself, or the public path remains reachable alongside the new private one.
Reflection Question: Why would leaving public network access enabled on a resource undermine the security benefit of also configuring a Private Endpoint for it?
