3.3.4. Private Endpoints and Azure Private Link
💡 First Principle: A PaaS resource with a public endpoint is reachable from the internet by definition, however tightly its firewall rules are configured. A Private Endpoint gives the resource a private IP address inside your own VNet so your traffic never needs that public path — and once public network access is disabled, the private path becomes the only one.
Azure Private Link is the underlying service that enables private, VNet-based connectivity to Azure PaaS resources (Storage, Key Vault, SQL, and others) and to your own Private Link services. A Private Endpoint is the specific network interface, provisioned inside your VNet with a private IP, that represents the connection to a given PaaS resource — traffic from your VNet to that resource never traverses the public internet. This differs meaningfully from service endpoints, which extend your VNet's identity over the Microsoft backbone so the resource's firewall can admit that subnet, but leave the resource on its public endpoint.
⚠️ Exam Trap: Configuring a Private Endpoint for a storage account doesn't automatically block the account's existing public endpoint — you typically also need to explicitly disable public network access on the resource itself, or the public path remains reachable alongside the new private one.
Reflection Question: Why would leaving public network access enabled on a resource undermine the security benefit of also configuring a Private Endpoint for it?
