Private Endpoints & Private Link
A private IP inside your subnet for a PaaS resource, with DNS and public-access settings being the real work.
Readiness
0%
2h baseline
Exam memorization points
- A private endpoint is a network interface with a private IP allocated from a subnet, bound to a specific resource and sub-resource (for example blob or dfs).
- Private Link is the underlying service that offers Azure PaaS and your own load-balancer-fronted services privately.
- DNS is the critical piece: create the matching privatelink zone (for example privatelink.blob.core.windows.net) and link it to the client VNets.
- Approval flow: auto-approved when the caller owns both sides, otherwise the request waits for manual approval on the target resource.
- Private endpoint subnet network policies (NSG and UDR support) are off by default and must be enabled on the subnet.
- Private endpoints complement, rather than replace, the public firewall: you must set public network access to Disabled when you want private-only.
Traps & distractors
- Creating the private endpoint but not the private DNS zone, leaving clients resolving the public IP.
- Assuming public access is disabled automatically by adding a private endpoint. It is not.
- Placing a private endpoint in the GatewaySubnet, which is not allowed.
- Forgetting that on-premises DNS needs a forwarder so that privatelink zones resolve from corporate networks.
- Expecting the private DNS record to be cleaned up when the private endpoint is deleted - stale records commonly survive.
Suggested lab
Blob storage over a private endpoint
End-to-end private connectivity with DNS proof.
- 1Create a storage account and a private endpoint for the blob sub-resource in a dedicated private-endpoint subnet.
- 2Enable private endpoint network policies on that subnet and examine the DNS configuration blade.
- 3Create the privatelink.blob.core.windows.net private DNS zone and link it to the VNet; confirm the A record appears.
- 4Set the storage account public network access to Disabled.
- 5From a VM in the VNet run nslookup on the account name and confirm it resolves to the 10.x private address.
Microsoft Learn
- What is a private endpoint?doc
- Search Microsoft Learn: private link private endpoint private DNS zone public network accesssearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Critical priority
High-yield and still weak. Study this next.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight78% × 25% = 19.4
This topic's domain carries 17.5% of the exam objectives.
- Dependency leverage20% × 20% = 4.1
1 later topic depend on it.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Baseline study time
2h
Complexity
3 / 5
Remaining to target
1h 42m
Status weight
0%
Topics: private link, private endpoint, privatelink, dns, approval, sub-resource
Weak neighbours in Networking