Azure Private Endpoint vs Service Endpoint: Complete Comparison of Secure PaaS Connectivity Patterns

When you need secure access from VNet resources to Azure PaaS services (Storage Account, SQL Database, Cosmos DB, Key Vault, etc.), you have two patterns to choose from: Private Endpoint and Service Endpoint. This article compares how each works, their cost, security characteristics, and the scenarios they fit — and walks through the correct way to use Private Endpoint, which has become the modern best practice.

Side-by-Side Comparison of the Two Patterns

How Service Endpoint Works

Service Endpoint routes outbound traffic from a subnet in your VNet to specific Azure PaaS services over the Azure backbone. On the PaaS side, you configure a firewall rule that says "allow only traffic from this VNet/subnet," which keeps the PaaS public endpoint in place while delivering effective network isolation.

How traffic flows

1. Enable a Service Endpoint on the subnet (e.g., Microsoft.Storage)
2. On the PaaS service (Storage Account), configure a firewall rule to allow access only from this VNet/subnet
3. Access from a VM in the VNet to the Storage Account is routed over the Azure backbone
4. The source IP reaches the PaaS as the subnet's public IP (a Service Endpoint quirk)

Pros and cons

• Pros: free, easy to configure, and works in legacy environments
• Cons: the PaaS public endpoint remains (DDoS exposure), no direct on-premises access, and it is hard to prove for compliance that data never leaves the organization's network

How Private Endpoint Works

Private Endpoint places the Azure PaaS service inside the VNet as a private IP. The PaaS service effectively becomes a VNet member; under the hood, the connection runs through the Microsoft-operated Private Link Service to reach the PaaS resource.

How traffic flows

1. Create a Private Endpoint in the VNet (e.g., assign private IP 10.0.1.4 to the Storage Account)
2. Link a Private DNS Zone (e.g., privatelink.blob.core.windows.net) to the VNet
3. Disable the Storage Account's public endpoint
4. A DNS query from a VM in the VNet for mystorageaccount.blob.core.windows.net resolves to the private IP (10.0.1.4)
5. VM → private IP 10.0.1.4 → Storage Account, end-to-end over a fully private path

Pros and cons

• Pros: you can disable the PaaS public endpoint (zero internet exposure), reach the service directly from on-premises via VPN/ExpressRoute, strengthen compliance posture, and align with zero-trust principles
• Cons: paid (about ¥700/month per service + data transfer), requires Private DNS Zone design, requires enabling Network Policy on the subnet, and consumes IP addresses

Private DNS Zone and Name Resolution

Name resolution for Private Endpoint is handled by a dedicated Private DNS Zone. Each service has a specific zone name.

When you create the Private Endpoint, setting the Integrate with private DNS zone option to Yes will automatically create the matching Private DNS Zone, link it to the VNet, and register the A record. When multiple VNets share the same Private DNS Zone, the standard design is to consolidate it in a hub VNet.

Resolving from On-Premises

To access a Private Endpoint from an on-premises environment, you need to design the DNS resolution path.

• Pattern A (simple): register the Private Endpoint's FQDN with its private IP directly as an A record on the on-prem DNS server. Manual to operate; brittle as resources change.
• Pattern B (recommended): deploy an Azure DNS Private Resolver inbound endpoint in the VNet, configure a conditional forwarder on the on-prem DNS to that inbound endpoint's IP, and let the Private DNS Zone resolve the names.
• Pattern C (DNS Forwarder VM): stand up a DNS forwarder VM (BIND, etc.) inside the VNet and forward from on-prem DNS. A legacy pattern from before Azure DNS Private Resolver shipped.

Integration with NSG / Firewall

NSG support for Private Endpoint rolled out gradually starting in 2021 and is now available in all GA regions.

• Enable Private Endpoint Network Policies on the subnet (disabled by default — you must enable it explicitly)
• Apply an NSG to the subnet to control traffic to the Private Endpoint by IP/port
• Use a UDR to set the next hop for the Private Endpoint to Azure Firewall, routing traffic through the firewall
• Delivering traffic from Application Gateway / Front Door to a Private Endpoint requires combining with Private Link Service

Supported Services

As of 2026, nearly every major Azure PaaS service supports Private Endpoint.

• Storage: Blob / File / Queue / Table / Data Lake Gen2
• Database: SQL DB / Managed Instance / Cosmos DB / PostgreSQL / MySQL
• Compute: App Service / Functions / Container Apps / AKS Private Cluster
• Container: Azure Container Registry
• Security: Key Vault / Managed HSM
• Messaging: Event Hub / Service Bus / Event Grid
• AI / Search: Azure AI Search / Azure AI Foundry / Azure OpenAI / Azure Machine Learning
• Data: Synapse Analytics / Data Factory / Microsoft Purview / Microsoft Fabric
• Operations: Azure Monitor (Private Link Scope) / Automation / Backup / Site Recovery
• Configuration: App Configuration

Private Endpoint Limitations

1. Each Private Endpoint occupies 1-3 private IPs in the VNet, which impacts IP address planning.
2. Unless you explicitly enable Private Endpoint Network Policies on the subnet, NSG and UDR will not apply to the Private Endpoint.
3. Once created, a Private Endpoint cannot be moved to another subnet — you must delete and recreate it.
4. Some services use a connection approval workflow that requires the PaaS resource owner to approve the request (when set to Manual Approval).
5. Cost: $0.01/h × 730h ≈ ¥700/month + data transfer. Watch the running total if you plan to create many Private Endpoints.

Which Should You Choose?

Selection guide for new projects in 2026:

• Security / compliance focused: Private Endpoint is the only choice. Required for GDPR, HIPAA, PCI DSS, and APPI.
• On-premises access required: Private Endpoint is the only choice. Service Endpoint only works from inside the VNet.
• Cost minimization is the top priority: consider Service Endpoint (¥700/month × dozens of services adds up).
• New PaaS service that does not yet support Private Endpoint: use Service Endpoint as a temporary measure and migrate once Private Endpoint support lands.

Related Certifications

• AZ-700 (Network Engineer Associate): Private Endpoint and Service Endpoint are tested in depth.
• AZ-104 (Administrator): fundamentals appear in Domain 4.
• AZ-305 (Solutions Architect Expert): architect-level selection criteria.
• SC-100 (Cybersecurity Architect Expert): zero-trust network design.

Frequently Asked Questions

The technical information in this article is based on the Azure Private Link Documentation. This article is not an official Microsoft Corporation product and has no affiliation or sponsorship with Microsoft. Microsoft and Azure are trademarks of the Microsoft group of companies. Information is based on publicly available official material as of May 24, 2026. Always check the official pages for the latest information.