Azure Private Link

About Azure Private Link

Azure Private Link is Microsoft Azure's private connectivity service for reaching supported Azure platform services, partner offerings, and customer-owned services through private IP addresses instead of exposing those service endpoints to the public internet. Its main building block is a private endpoint, which places a network interface with a private IP address inside a virtual network and maps that address to a supported Private Link resource. Private Link is most useful when an organization wants PaaS access to stay on the Microsoft backbone while preserving familiar Azure service models such as Storage, SQL Database, Key Vault, App Service, and other supported services.

What is Azure Private Link used for?

Azure Private Link is used when applications, administrators, or connected networks need private access to Azure services that would otherwise be reached through public service endpoints. A private endpoint gives the selected service a private IP address in a virtual network, so workloads can connect through private network paths while the service itself remains managed by Azure.

Common designs include privately connecting an application subnet to Azure Storage or Azure SQL Database, exposing a provider-owned application privately to customer virtual networks, and extending access from on-premises networks through VPN or ExpressRoute. Private Link does not replace the application service, firewall rules, identity controls, or DNS design. It changes how the service is reached and is therefore one part of a broader network and security architecture.

How do private endpoints work?

A private endpoint is a network interface that Azure creates inside the customer's virtual network. It receives a private IP address from the selected subnet and maps that address to a supported Private Link resource. Microsoft documents that the private endpoint must be deployed in the same region and subscription as the virtual network, while the target Private Link resource can be in another region.

The private IP remains associated with the private endpoint for its lifecycle. Multiple private endpoints can point to the same service when separate networks, subscriptions, or environments need isolated connections. Microsoft recommends avoiding unnecessary duplicate endpoints in a network that shares the same DNS configuration because duplicate DNS entries and conflicting resolution can make private connectivity harder to operate.

What security controls apply to private endpoints?

Private endpoint traffic is restricted to the specific Private Link resource or subresource that the endpoint targets. Microsoft also supports network policies on private endpoints, including Network Security Groups, User Defined Routes, and Application Security Groups where supported. These controls can help organizations apply subnet-level filtering or route private endpoint traffic through network virtual appliances.

Private Link does not automatically disable a target service's public endpoint. The service's own networking or firewall configuration still determines whether public access remains available. Teams that require private-only access should explicitly disable or restrict public network access on the target resource when that service supports the setting.

Why is DNS important with Azure Private Link?

Private Link deployments depend heavily on name resolution. Applications usually continue to connect to the service's normal fully qualified domain name, but DNS must resolve that name to the private endpoint address from networks that should use the private path. Microsoft publishes private DNS zone names for services that support private endpoints, and Azure Private DNS is commonly used to host those records.

This makes DNS design one of the biggest operational differences between a simple proof of concept and a production deployment. Hub-and-spoke environments, hybrid networks, custom DNS servers, multiple Azure regions, and split-horizon requirements can all affect how names are resolved. A private endpoint can be technically healthy while an application still fails because its DNS query returns the public endpoint instead of the private IP.

How is Private Link different from service endpoints?

Both Private Link and virtual network service endpoints help restrict access to Azure services, but they work differently. A service endpoint extends the identity of a virtual network subnet to a supported Azure service while clients still address the service through its public endpoint. Private Link instead places a private endpoint with a private IP inside the virtual network.

Microsoft currently recommends Private Link and private endpoints for secure private access to services hosted on Azure. Service endpoints can still be useful in simpler or large-scale designs where subnet identity and service firewall rules meet the requirement without the additional private endpoint and DNS architecture. Buyers should choose based on isolation, network topology, DNS complexity, supported-service behavior, and cost rather than treating one model as automatically superior for every workload.

What is Azure Private Link Service?

Private Link Service is the provider-side feature for publishing a customer-owned or partner-owned service privately to consumers. In the standard design, the provider places the service behind an Azure Standard Load Balancer and creates a Private Link Service that references the load balancer frontend. Consumers then create private endpoints in their own virtual networks and request connections to that service.

The provider can control service visibility and approve or reject connection requests. Microsoft documents a globally unique alias that can be shared with consumers, and providers can use auto-approval for selected subscriptions. Standard Private Link Service supports provider-side NAT IP configurations and private endpoint connection controls.

What changes with Private Link Service Direct Connect?

Microsoft now documents Private Link Service Direct Connect as a public preview capability in selected regions. Direct Connect allows a Private Link Service to route directly to a privately routable destination IP address and bypass the Standard Load Balancer requirement used by the standard provider architecture.

This can help with databases, legacy applications, custom services, third-party SaaS integrations, virtual appliances, and other scenarios that need direct IP routing. Microsoft requires the preview feature to be enabled for the subscription and requires at least two IP configurations, in multiples of two, for high availability. Because this is a preview capability, teams should validate regional support, feature restrictions, and operational suitability before using it for production designs.

What are the current Azure Private Link limits?

Microsoft's current Azure limits document allows up to 1,000 private endpoints per virtual network, 4,000 private endpoints across peered virtual networks, and 64,000 private endpoints per subscription. A subscription can contain up to 800 Private Link Services, and one Standard Load Balancer can be associated with up to eight Private Link Services.

A Private Link Service can have up to eight NAT IP configurations and up to 1,000 private endpoints connected to the same service. Visibility settings and auto-approval settings each support up to 100 subscriptions. A private endpoint can have one private DNS zone group, with up to five DNS zones in that group, and the private endpoint network interface can expose up to 500 private IP addresses.

What private endpoint limitations should architects know?

Private endpoints have several practical limitations that matter in larger network designs. Microsoft currently lists static private endpoint IP configuration as unsupported for some services, including Azure Kubernetes Service, Application Gateway, HDInsight, Recovery Services vaults, and third-party Private Link services.

For private endpoint network interfaces, Azure portal effective routes and effective security rules are not displayed. NSG flow logs are also unavailable for inbound traffic destined for a private endpoint. Microsoft additionally recommends SNAT when traffic to a private endpoint traverses a network virtual appliance because the private endpoint data plane can otherwise create asymmetric return-path issues.

How is Azure Private Link priced?

Pricing was checked against Microsoft's current Azure Private Link pricing page on September 5, 2026. Microsoft does not present one flat subscription price. Private endpoints are billed for the time they exist, and inbound and outbound data processed through Private Link are additional usage meters. Standard data transfer charges can still apply depending on the traffic path.

Microsoft currently lists no charge for the Private Link Service resource itself. The provider infrastructure behind it, such as Standard Load Balancer, compute, storage, networking, or other Azure resources, can still have their own charges. Partial hours for private endpoint billing are charged as full hours, and access to a private endpoint from a peered virtual network incurs the Private Link premium rather than a separate peering charge for that access path.

What are the main design tradeoffs?

Private Link improves network isolation, but it adds components that must be governed. Teams need private endpoint lifecycle management, DNS zones and links, approval workflows, address-space planning, monitoring, quota tracking, and documentation of which resources are reachable from which networks. Large estates can accumulate hundreds or thousands of private endpoints if every team creates its own copy without a shared architecture.

Private Link also does not replace identity, application authorization, firewall policy, or service-specific controls. Service support and region availability should be checked before standardizing on Private Link because not every Azure capability exposes identical private endpoint options, and preview features such as Direct Connect require additional review.

Who should choose something else?

Teams should consider alternatives when the requirement is simpler than full private endpoint connectivity. Service endpoints may be adequate when subnet-based service restrictions are enough and the organization wants to avoid private endpoint DNS and lifecycle overhead. Application Gateway, Front Door, Load Balancer, VPN, ExpressRoute, Bastion, and Azure Firewall solve different network problems and should not be substituted for Private Link solely because they also improve network security or connectivity.

Private Link is a stronger fit when supported PaaS or provider services must appear through private IP addresses inside controlled virtual networks, especially for regulated, enterprise, hybrid, or segmented architectures. Organizations should still combine it with identity, service firewall settings, DNS governance, logging, and application-level security rather than treating private routing as a complete security control.