Azure Documentation

How Azure Private Link Works

Azure Private Link provides private connectivity from a virtual network to Azure Platform as a Service (PaaS), customer-owned, and Microsoft partner services. Azure Private Link enables you to access these services from your Azure virtual network without going over the public internet. Traffic between your virtual network and the service travels the Microsoft backbone network.

Core Components

Azure Private Link relies on three core components:

• Private Endpoint: A network interface that connects privately and securely to a specific service. It's deployed within your virtual network.
• Private Link Service: A service that exposes your own service (e.g., an application running on an Azure Load Balancer) to consumers via Azure Private Link.
• Azure Private Link: The managed service that orchestrates the secure, private connectivity.

Scenario 1: Accessing Azure PaaS Services Privately

This is the most common scenario. You want to access an Azure PaaS service, such as Azure SQL Database, Azure Storage, or Azure Key Vault, from your virtual network privately.

Conceptual diagram for accessing Azure PaaS services.

Here's how it works:

1. Create a Private Endpoint: You create a private endpoint in your virtual network. This private endpoint gets a private IP address from your virtual network.
2. Link to Service: The private endpoint is configured to connect to a specific Azure PaaS service.
3. DNS Resolution: Azure DNS Private Zones are typically used to resolve the service's FQDN (Fully Qualified Domain Name) to the private IP address of the private endpoint.
4. Traffic Flow: When an application in your virtual network tries to access the PaaS service using its FQDN, the DNS resolution directs the traffic to the private IP address of the private endpoint. The traffic then traverses the Microsoft backbone network directly to the PaaS service, bypassing the public internet.

Scenario 2: Exposing Your Own Service Privately

This scenario involves making your own application or service hosted within Azure (or on-premises via VPN/ExpressRoute) accessible to other Azure virtual networks privately.

Conceptual diagram for exposing your own services.

Here's the process:

1. Deploy Your Service: Host your service behind an Azure Load Balancer (Standard SKU) in your subscription.
2. Create a Private Link Service: Create a Private Link Service resource that references your Load Balancer. This service acts as the entry point for consumers.
3. Consumer Creates Private Endpoint: A consumer in a different virtual network (or even your own) creates a private endpoint and links it to your Private Link Service.
4. Secure Connectivity: Once the connection is approved (either automatically or manually by the service provider), the consumer's private endpoint connects securely to your Private Link Service. Traffic flows privately between the consumer's virtual network and your service.

Benefits of Azure Private Link

• Enhanced Security: Eliminates exposure to the public internet.
• Simplified Network Architecture: Reduces the need for complex network configurations like VNet peering or VPN gateways for public endpoints.
• Consistent Experience: Provides a unified connectivity experience for accessing Azure PaaS, partner, and customer-owned services.
• Data Exfiltration Protection: Helps prevent unauthorized data leakage.

Key Considerations

• Private endpoints require a Standard SKU Load Balancer for scenarios involving customer-owned services.
• Proper DNS configuration is crucial for seamless name resolution to private endpoints.
• Connection approval workflows are important for security when sharing services.