Configuring private endpoints – Implementing and Managing Virtual Networking

Configuring private endpoints

Azure Private Link enables you to access Platform as a Service (PaaS) services such as Azure Storage and SQL databases, and Azure-hosted services over a private endpoint in your own VNet.

Much like service endpoints, private endpoints allow traffic between a VNet and a service to travel through the Microsoft backbone network. This way, exposing your service over the internet is no longer required.

A key difference between service endpoints and private endpoints is that service endpoints connect to Azure/Microsoft services over their backbone while the PaaS resources are still outside of the VNet and, thus, need to be routed as such, whereas private endpoints bring the resources directly into your VNet. It is important to understand that private endpoints keep all the traffic within your VNet:

1. Let’s go ahead and configure a Key Vault private endpoint via the Azure portal using the following steps:
2. Navigate to the Azure portal by opening a web browser and visiting the following URL: https://portal.azure.com.
3. Under Create a resource, search for private link and click on Create.
4. Next, click on Create private endpoint:

Figure 14.32 – Creating a private endpoint

5. Next, choose a subscription, RG, name, and region:

Figure 14.33 – Page one of creating a private endpoint

6. Next, we choose a subscription from the drop-down list, select Resource type as Microsoft.KeyVault/vaults, and choose the name for the existing resource, and the target sub-resource:

Figure 14.34 – Page two of creating a private endpoint

7. Next, select the VNet that you want the Key Vault service to be added to, as well as the Subnet name. Set Private DNS integration to No:

Figure 14.35 – Page three of creating a private endpoint

8. Next, it is optional to provide a name and value as a resource tag. In our case, we’re going to skip this for now.
9. On the Review and create tab, click Create.
10. Finally, once the private endpoint has been created successfully, you can verify it by navigating to the resource and confirming that Connection status is Approved:

Figure 14.36 – Verifying that the private endpoint has been created successfully

In this section, we had a look at what private endpoints are and how they differ from service endpoints, and learned how to configure private endpoints for an existing key vault and VNet.

We encourage you to read up further on Azure private endpoints by visiting the following links:

• https://docs.microsoft.com/en-us/azure/private-link/ private-link-overview

• https://docs.microsoft.com/en-us/azure/private-link/ create-private-endpoint-portal

• https://docs.microsoft.com/en-us/azure/private-link/ private-endpoint-dns