Azure Documentation

Quickstart: Set up Azure Private Link

This quickstart guide walks you through the steps to set up Azure Private Link, allowing you to securely access Azure Platform as a Service (PaaS) resources or your own services within a virtual network using a private endpoint.

Prerequisites

  • An active Azure subscription. If you don't have one, create a free account before you begin.
  • A virtual network and subnet where you will deploy your private endpoint.
  • An Azure resource that supports Private Link (e.g., Azure Storage, Azure SQL Database). For this example, we'll use Azure Storage.

Step 1: Create an Azure Storage Account

If you don't have an existing storage account, create one:

  1. Go to the Azure portal.
  2. Search for "Storage accounts" and select it.
  3. Click "Create".
  4. Fill in the required details (Subscription, Resource group, Storage account name, Region, Performance, etc.).
  5. Click "Review + create", then "Create".

Step 2: Create a Private Endpoint

You will create a private endpoint for your storage account. This endpoint will reside in your virtual network.

1

In the Azure portal, search for "Private Link center" and select it.

2

Under "Private endpoints", click "Create".

3

On the "Basics" tab, fill in the following details:

  • Subscription: Select your subscription.
  • Resource group: Select an existing resource group or create a new one.
  • Name: Enter a name for your private endpoint (e.g., my-storage-pe).
  • Region: Select the same region as your virtual network.
4

On the "Resource" tab:

  • Connection method: Select "Connect to an Azure resource in my directory".
  • Subscription: Select the subscription where your storage account resides.
  • Resource type: Select "Microsoft.Storage\storageAccounts".
  • Resource: Select your storage account.
  • Target sub-resource: Select "blob" (or "file", "queue", "table" depending on your needs).
5

On the "Virtual Network" tab:

  • Virtual network: Select your virtual network.
  • Subnet: Select the subnet within your virtual network.
  • Private DNS integration: Leave as "Yes" to create a private DNS zone.
6

On the "Tags" tab (optional), add tags if needed.

7

Click "Review + create". Once validation passes, click "Create".

Step 3: Verify Private Endpoint Connectivity

After the private endpoint is deployed, you should be able to access your storage account privately.

Tip: Ensure your virtual machine or resource attempting to connect is within the same virtual network or a peered network where the private endpoint is deployed.
  1. Deploy a virtual machine (VM) in the same virtual network as your private endpoint.
  2. Connect to the VM.
  3. Open a web browser on the VM and navigate to the Azure portal.
  4. Search for and select your storage account.
  5. Go to "Access keys" under "Security + networking". Note that publicly accessible endpoints might still show, but your private endpoint is the preferred access method.
  6. Try accessing a blob or file share within your storage account. It should now be accessible via the private IP address assigned to your private endpoint.

Accessing via Private DNS

If you enabled Private DNS integration, Azure automatically creates a private DNS zone and a record set for your storage account's FQDN (e.g., yourstorageaccount.blob.core.windows.net). This record points to the private IP address of your private endpoint.

You can verify this in the Azure portal under your private endpoint's resource page, then look for "DNS configuration".

Important: If you are using on-premises resources or resources in other networks that need to resolve the private endpoint FQDN, you'll need to configure conditional forwarders or VPN/ExpressRoute connectivity to your Azure DNS zone.

Next Steps

You have successfully set up a basic Azure Private Link configuration. Consider exploring:

  • Securing your storage account by disabling public network access.
  • Creating private endpoints for other Azure services.
  • Using Azure Private Link service to expose your own services privately.
  • Managing Private Link configurations using Azure CLI or PowerShell.

For more detailed information and advanced scenarios, refer to the Azure Private Link documentation.