# Private Link: allow Azure is not private Source: https://ai.techclick.in/blog_azure_private_link_vs_public Markdown: https://ai.techclick.in/blog_azure_private_link_vs_public.md Publisher: Techclick Infosec Pvt Ltd Private Endpoint for PaaS vs public + firewall IPs. Allow Azure services is not private. Dummy spoke 10.41.0.0/16. ## The ticket CISO: “SQL is not on the internet.” The SQL blade shows Public network access = Selected networks, plus Allow Azure services on. A scanner in another tenant’s VM can still reach it from an Azure IP. You documented “private.” It is not. Quick interview answer Private Endpoint puts a NIC in your VNet (here the spoke 10.41.0.0/16) that maps to a PaaS resource (Storage, SQL, Key Vault, …). Traffic stays on the Microsoft backbone to that resource. Private Link is the platform that publishes the service to that NIC. Public + firewall IP list is still a public endpoint. “Allow trusted Azure services / Allow Azure services” is an exception for Azure-sourced IPs — not your VNet. Disable public access when the endpoint is live, and fix DNS with the privatelink.* zone so the FQDN returns the private IP. Hero · private NIC 10.41 is private. “Allow Azure” is a crowd. Lab data · dummy only Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10 . Not a live tenant. ## Mental model Mode Who can hit it This lab Public + any The internet Never for pay-api data Public + IP list Those IPs (and whoever shares them) Break-glass only, if ever Public + Allow Azure services Azure-sourced IPs, not “our VNet” Not private Private Endpoint, public off Your VNet / peered / on-prem via hub pe-sql-pay in 10.41.0.0/16 Same FQDN, different answer - Public endpoint sql-pay.database.windows.net → public VIP Private Endpoint same FQDN via privatelink zone → 10.41.2.10 on spoke NIC If DNS still returns the public VIP, you built a museum piece. The app never uses the NIC. ## How to choose Need Do Do not PaaS from pay-api / on-prem Private Endpoint + privatelink DNS Allow Azure services Partner on the internet Their IP on the public firewall, or a different pattern Pretend PE is optional kv-tc-lab PE in the spoke, public disabled Portal-only “from my IP” forever https://portal.azure.com Training mock · not live Azure portal Home Microsoft Entra ID Virtual networks Azure Firewall Private endpoints → pe-sql-pay ### Overview Resource sql-pay · Microsoft.Sql NIC IP 10.41.2.10 · spoke 10.41.0.0/16 Public network access Disabled Private DNS zone privatelink.database.windows.net Allow Azure services Off — not a private control Cancel Save Private Endpoint NIC + public off. Training mock. ## Runbook #### Side A — endpoint Create PE in the spoke subnet (not GatewaySubnet, not AzureFirewallSubnet). Approve it. Repeat for kv-tc-lab if that vault is still public. - #### Side B — DNS Private DNS zone + VNet link on hub and spoke (and on-prem conditional forwarder to the hub if Priya must resolve it). FQDN must return 10.41.2.10 from pay-api. - #### Side C — prove Disable public network access. From pay-api: resolve + connect. From a random Internet host: fail. From another Azure VM that is not peered: fail. az · dummy az network private-endpoint list -g rg-spoke -o table # Name PrivateIP Resource # pe-sql-pay 10.41.2.10 sql-pay # pe-kv-lab 10.41.2.11 kv-tc-lab # on pay-api nslookup sql-pay.database.windows.net # 10.41.2.10 # If you see a public A record, DNS is wrong — PE is unused. ## Four failures ### 1 · Allow Azure services = private It is not. It is “Azure-sourced.” ### 2 · PE without DNS Clients still hit the public VIP. Public disable then looks like an outage. ### 3 · Public left On You now have two doors. Attackers use the old one. ### 4 · PE in the hub, no route/DNS for the spoke Works from a jump box in the hub. Dies on pay-api. Design DNS + UDR deliberately. ## How to prove it Close only when 1) FQDN from pay-api = 10.41.x.x. 2) Public access is Disabled. 3) Allow Azure services is off. 4) A non-peered Azure VM cannot connect. ## Traps Looks locked Is not Selected networks + Allow Azure Other tenants’ Azure IPs Private Endpoint created Public still On + public DNS Service endpoint on the subnet Still a public PaaS VIP, just from that VNet — not Private Link ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 A Private Endpoint is… A public VIP with a nicer name A NIC in your VNet that maps to a PaaS resource An NSG rule Allow Azure services Correct: b . PE = NIC in your VNet. Q2 Allow Azure services on SQL/Storage means… Only your VNet Azure-sourced IPs — not private Private Link is on Public access is off Correct: b . Not a perimeter. Q3 After creating a PE you must still… Leave public On Fix DNS so the FQDN returns the private IP, then disable public Put the PE in GatewaySubnet Disable Entra Correct: b . DNS + public off. Q4 nslookup from pay-api still returns a public A record. Effect? PE is used automatically The app never uses the private NIC WAF decrypts SQL UDR is enough Correct: b . Failure 2. Q5 Service endpoint vs Private Endpoint? Same thing Service endpoint still targets the public PaaS VIP from the VNet; PE gives a private NIC Service endpoint is L7 WAF PE is only for VMs Correct: b . Trap. Q6 Proof SQL is actually private? The blade says Selected networks Private IP resolve + public Disabled + non-peered Azure VM fails A green check on Allow Azure NSG name contains Private Correct: b . Verify. Check answers Reset Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview ## Sources - Microsoft Learn — What is Azure Private Link? . Related: Azure session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt