Azure Documentation

Create a Private Endpoint

Navigate to the Azure portal. Search for "Private Link" and select it. Click on "Create a private endpoint".

• Subscription: Select your Azure subscription.
• Resource group: Choose or create a resource group for your private endpoint.
• Instance details:
• Name: Provide a descriptive name for your private endpoint (e.g., my-sql-private-endpoint).
• Region: Select the same region as your virtual network.
• Resource:
• Connect from: Select "My subscription".
• Connection method: Choose "Connect to an Azure resource from my subscription".
• Resource type: Select the type of Azure service you want to connect to (e.g., Microsoft.Sql/servers for Azure SQL Database).
• Resource: Select the specific Azure resource instance.
• Target sub-resource: Specify the sub-resource if applicable (e.g., sqlServer for Azure SQL).
• Configuration:
• Virtual network: Select the virtual network where you want to deploy the private endpoint.
• Subnet: Choose the subnet within your virtual network.
• Private DNS integration: For seamless name resolution, it's highly recommended to enable "Yes" for Private DNS integration. This will automatically create or update a private DNS zone.

Click Review + create, then Create.

Approve the Private Endpoint Connection (if necessary)

If the Azure service you are connecting to requires approval for incoming connections, you will need to approve the private endpoint connection request on the service's resource page.

For example, on the Azure SQL Database resource, navigate to "Private endpoint connections" and approve the pending connection.

Configure DNS Resolution

If you enabled Private DNS integration in Step 1, Azure will automatically create a private DNS zone (e.g., privatelink.database.windows.net) and a virtual network link. A DNS A record will be created pointing to the private IP address of your private endpoint.

If you did not enable Private DNS integration, you will need to manually configure your DNS settings:

1. Create a private DNS zone in Azure DNS for the service's domain (e.g., privatelink.database.windows.net).
2. Create an A record within this zone that maps the fully qualified domain name (FQDN) of your service to the private IP address of your private endpoint. You can find the private IP address on the Overview page of your Private Endpoint.
3. Link the private DNS zone to your virtual network.

Example of manually creating an A record (using Azure CLI):

Connect to the Service

Once the private endpoint is created, approved, and DNS is configured, you can connect to your Azure service using its standard FQDN. The connection will now be routed through the private endpoint within your virtual network.

For example, when connecting to your Azure SQL Database, use its FQDN (e.g., your-sql-server.database.windows.net) from a resource within the associated virtual network.