7.2 Azure Private Endpoints & Private Link Architecture

Azure Private Endpoints & Private Link Architecture

While Service Endpoints optimize routing across the Azure backbone, they still require interacting with the PaaS service's public IP address and lack transitive hybrid reachability. Azure Private Link represents the ultimate evolution in private cloud access, bringing Azure PaaS services, customer-owned applications, and third-party SaaS solutions directly inside your Virtual Network's private IP address space.

At the core of this architecture is the Azure Private Endpoint—a specialized virtual network interface (NIC) deployed within a customer-managed subnet. This private network interface is assigned a private IP address drawn directly from the subnet's CIDR block, transforming the remote PaaS service into a first-class private node within the virtual network.

1. Private Endpoint Core Mechanics & Unidirectional Security

When you provision a Private Endpoint for an Azure resource (e.g., an Azure SQL Database or Azure Storage Account), Azure creates a read-only Network Interface inside your specified subnet.

+-----------------------------------------------------------------------------+
|                   AZURE PRIVATE ENDPOINT ARCHITECTURE                       |
|                                                                             |
|   CUSTOMER VIRTUAL NETWORK (10.2.0.0/16)                                    |
|   +---------------------------------------------------------------------+   |
|   | Subnet-App (10.2.1.0/24)                                            |   |
|   | [VM: 10.2.1.10]                                                     |   |
|   |       |                                                             |   |
|   |       | (Standard TCP/IP Flow: Dest = 10.2.2.5)                     |   |
|   |       v                                                             |   |
|   | Subnet-PrivateEndpoints (10.2.2.0/24)                               |   |
|   | [Private Endpoint NIC: 10.2.2.5]                                    |   |
|   +---------------------------------------------------------------------+   |
|                            |                                                |
|                 (Azure SDN Encapsulation)                                   |
|                 (Microsoft Global Mesh  )                                   |
|                            v                                                |
|   MICROSOFT PAAS INFRASTRUCTURE / MULTI-TENANT FABRIC                       |
|   +---------------------------------------------------------------------+   |
|   | Azure SQL Database Instance (Target Resource)                       |   |
|   | - Public Access: DISABLED (0.0.0.0 / No Public Exposure)            |   |
|   | - Private Link Connection: Active & Linked to NIC 10.2.2.5          |   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

Key Architectural Characteristics:

1. Private IP Allocation: The Private Endpoint receives a private IP (e.g., 10.2.2.5) directly from your subnet. You can configure static IP allocation or allow DHCP to assign an address.
2. Unidirectional Connection Initiation: Communication across a Private Link is strictly one-way in initiation (consumer to provider). Workloads in your VNet can open TCP connections to the PaaS resource, but the PaaS resource cannot initiate inbound network connections into your VNet through the Private Endpoint.
3. Granular Instance Binding: A Private Endpoint connects to a specific, discrete resource instance (e.g., sqldb-production-eastus or blob sub-resource of storageacct01), rather than the entire service. This eliminates data exfiltration because compromised workloads cannot reach unauthorized instances through that endpoint.
4. Public Network Access Elimination: With Private Endpoints in place, you can configure the PaaS firewall's Public network access setting to Disabled, completely closing the PaaS resource's public IP and internet ingress.

2. Cross-Region, Cross-Subscription & Cross-Tenant Connectivity

One of the most powerful architectural capabilities of Azure Private Link is its ability to span organizational and regional boundaries without requiring traditional network interconnects.

Cross-Region Private Link

A Private Endpoint deployed in a Virtual Network in East US can connect directly to a PaaS service or Private Link Service hosted in West Europe or Southeast Asia. The traffic is encapsulated and transported securely across Microsoft's dedicated global dark fiber backbone.

• No VNet Peering Required: You do not need to configure Global VNet Peering between regions.
• Bandwidth & Latency: Cross-region traffic benefits from Microsoft's predictable backbone performance, though standard cross-region data transfer fees apply.

Cross-Subscription & Cross-Tenant Connection Workflow

Private Link allows a consumer in Tenant A / Subscription A to securely connect to a service hosted in Tenant B / Subscription B. When the consumer does not have Azure Role-Based Access Control (RBAC) permissions on the target resource, Azure enforces an asynchronous Connection Approval Workflow.

+-----------------------------------------------------------------------------+
|                 CROSS-TENANT PRIVATE LINK APPROVAL WORKFLOW                 |
|                                                                             |
|   CONSUMER (Tenant A / Sub A)                 PROVIDER (Tenant B / Sub B)   |
|   ---------------------------                 ---------------------------   |
|   1. Requests PE creation using                                             |
|      Target Resource ID or Alias                                            |
|      (State: 'Pending')                                                     |
|                                                             |               |
|                                                             v               |
|                                               2. Receives connection request|
|                                                  in Private Link Center     |
|                                               3. Reviews Consumer Request   |
|                                                  and clicks 'Approve'       |
|                                                             |               |
|   4. Connection State changes to <--------------------------+               |
|      'Approved'                                                             |
|   5. Data Plane traffic starts flowing                                      |
+-----------------------------------------------------------------------------+

Connection States Lifecycle:

• Pending: The Private Endpoint has been created by the consumer, but the resource owner has not yet granted authorization.
• Approved: The resource owner approved the request; the Azure SDN fabric programs the forwarding path and data flows immediately.
• Rejected: The resource owner denied the connection request.
• Disconnected: The resource owner or consumer severed an existing connection.

3. Private Endpoint Network Policies: NSG & UDR Management

Historically, subnets containing Private Endpoints operated with specialized network policy bypasses: Network Security Groups (NSGs) and User-Defined Routes (UDRs) were completely disabled for Private Endpoint NICs (PrivateEndpointNetworkPolicies: Disabled).

Modern Azure networking introduces granular control over Private Endpoint subnet policies via the subnet properties: PrivateEndpointNetworkPolicies.

+-----------------------------------------------------------------------------+
|                 PRIVATE ENDPOINT NETWORK POLICIES SETTINGS                  |
|                                                                             |
|   Property Value                     NSG Enforcement      UDR Enforcement   |
|   --------------------------------   ------------------   ---------------   |
|   Disabled (Legacy default)          Ignored for PE NIC   Ignored for PE    |
|   Enabled (or RouteTableEnabled /    ENFORCED for PE      ENFORCED for PE   |
|            NetworkSecurityGroup..)   Traffic              Traffic           |
+-----------------------------------------------------------------------------+

1. Network Security Group (NSG) Enforcement

When NSG policies are Enabled on the Private Endpoint subnet:

• Inbound NSG Rules: Evaluated on traffic arriving at the Private Endpoint NIC from client VMs in the VNet or on-premises. You can restrict which source subnets, IP ranges, or ports (e.g., TCP 1433 for SQL or TCP 443 for HTTPS) can communicate with the Private Endpoint.
• Outbound NSG Rules: Evaluated on responses returning from the Private Endpoint.

2. User-Defined Route (UDR) Enforcement

When Route Table policies are Enabled on the Private Endpoint subnet:

• Traffic Inspection via Firewall / NVA: Administrators can apply a UDR on client subnets pointing to an Azure Firewall (e.g., 10.2.2.5/32 -> Next Hop: VirtualAppliance), forcing all traffic destined for the Private Endpoint through the firewall for deep packet inspection and intrusion detection (IDPS).
• Asymmetric Routing Avoidance: If a UDR is applied on the client subnet pointing to a firewall, the firewall performs Source NAT (SNAT) or the Private Endpoint subnet must route response traffic back through the firewall to maintain stateful connection symmetry.

4. Deep Comparative Analysis: Service Endpoints vs. Private Endpoints

A central focus of the AZ-700 exam is selecting the appropriate private connectivity architecture based on precise functional, security, and topological constraints.