Private Link for secure service access in Azure - Step-by-Step Execution

Process Flow - Private Link for secure service access

Client VM in VNet

↓

Private Endpoint

↓

Azure Private Link Service

↓

Azure Service (e.g., Storage, SQL)

↓

Traffic stays inside Azure backbone network

Client VM connects to Azure service through a private endpoint, keeping traffic secure inside Azure's network.

Execution Sample

Azure

az network private-endpoint create \
  --name myPrivateEndpoint \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --subnet mySubnet \
  --private-connection-resource-id /subscriptions/.../resourceGroups/.../providers/Microsoft.Storage/storageAccounts/myStorageAccount \
  --group-ids blob \
  --connection-name myConnection

Creates a private endpoint in a VNet subnet to securely connect to an Azure Storage account.

Process Table

Step	Action	Resource Created/Used	Network Path	Result
1	Create VNet and Subnet	VNet: myVNet, Subnet: mySubnet	N/A	Network ready for private endpoint
2	Create Private Endpoint	Private Endpoint: myPrivateEndpoint	Client VM -> Private Endpoint	Private IP assigned in subnet
3	Link Private Endpoint to Storage	Storage Account: myStorageAccount	Private Endpoint -> Storage	Secure private connection established
4	Client VM accesses Storage	Client VM	Client VM -> Private Endpoint -> Storage	Traffic stays inside Azure backbone
5	DNS Resolution	Private DNS Zone linked	Client VM resolves storage account to private IP	Name resolves to private IP
6	Access Storage via Private Link	Storage Account	Traffic does not go over public internet	Secure access confirmed
7	Exit	N/A	N/A	Private Link connection active and secure

💡 Private Link connection established, traffic secured inside Azure network

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
Private Endpoint IP	None	10.0.1.5 (example)	10.0.1.5	10.0.1.5	10.0.1.5
DNS Resolution	Public IP	Public IP	Public IP	Private IP	Private IP
Network Path	Client VM -> Internet -> Storage	Client VM -> Private Endpoint	Client VM -> Private Endpoint -> Storage	Client VM -> Private Endpoint -> Storage	Client VM -> Private Endpoint -> Storage

Key Moments - 3 Insights

Why does the client VM use a private IP to access the storage instead of the public IP?

Because the private endpoint assigns a private IP in the subnet and DNS resolves the storage account name to this private IP, as shown in execution_table step 5.

Does traffic to the Azure service go over the public internet after setting up Private Link?

No, traffic stays inside Azure's backbone network via the private endpoint, as shown in execution_table steps 4 and 6.

What role does the Private DNS Zone play in Private Link access?

It ensures the storage account name resolves to the private IP of the private endpoint, enabling secure access, as shown in execution_table step 5.

Visual Quiz - 3 Questions

Look at the execution_table, what is the Private Endpoint IP after step 2?

A 10.0.1.5 (example)

B Public IP of storage

C None assigned yet

D Subnet gateway IP

💡 Hint

Check variable_tracker row 'Private Endpoint IP' after Step 2

At which step does DNS resolution change from public IP to private IP?

A Step 2

B Step 5

C Step 3

D Step 6

💡 Hint

See execution_table step 5 and variable_tracker 'DNS Resolution'

If the private endpoint was not linked to the storage account, what would happen to the network path?

A Storage would be inaccessible

B Traffic would still go through private endpoint

C Client VM would access storage via public internet

D Client VM would use VPN automatically

💡 Hint

Refer to variable_tracker 'Network Path' before step 2

Concept Snapshot

Private Link lets you connect to Azure services privately.
Create a private endpoint in your VNet subnet.
DNS resolves service name to private IP.
Traffic stays inside Azure network, not public internet.
Secure, private access to services like Storage or SQL.

Full Transcript

Private Link for secure service access creates a private endpoint in your virtual network subnet. This endpoint gets a private IP address. When a client VM accesses the Azure service, DNS resolves the service name to this private IP. Traffic flows through the private endpoint inside Azure's backbone network, avoiding the public internet. This setup secures your service access by keeping data private and protected within Azure's infrastructure.