Azure Documentation

Troubleshoot Private Link Connectivity

This document provides common troubleshooting steps for issues encountered when setting up or using Azure Private Link. Private Link enables private connectivity from your virtual network to Azure platform services and to your own services hosted in Azure.

Connectivity Issues

If you are unable to connect to your private endpoint, check the following:

  • Network Security Groups (NSGs): Ensure that NSGs associated with your virtual network subnets (both for the client and the private endpoint) allow traffic to the required ports for the Azure service. The default ports vary by service.
  • Firewall Rules: Check any firewalls between your client and the private endpoint. Ensure outbound traffic is permitted to the service's endpoint IP.
  • DNS Resolution: Verify that the DNS records for your private service are resolving to the private IP address of the private endpoint. This is crucial for successful connection.
  • Private Endpoint Status: Confirm that the private endpoint resource in Azure is in a 'Succeeded' provisioning state.
  • Service-Specific Configuration: Some Azure services might require specific configuration within the service itself to allow connections from private endpoints. Consult the documentation for the specific service.
For DNS troubleshooting, you can use tools like nslookup or dig. For example: nslookup your-service-dns.privatelink.blob.core.windows.net. The output should show the private IP address of your Private Endpoint.

DNS Resolution Problems

Incorrect DNS configuration is a frequent cause of Private Link issues. Here's how to troubleshoot:

  • Private DNS Zone: If you are using an Azure Private DNS Zone, verify that the 'A' record for your service's FQDN (e.g., your-storage-account.privatelink.blob.core.windows.net) correctly points to the private IP address of your private endpoint.
  • Virtual Network Link: Ensure that the Private DNS Zone is linked to the virtual network where your private endpoint is deployed.
  • On-Premises DNS: If you are connecting from an on-premises network, ensure your on-premises DNS servers are configured to forward requests for the private link domain (e.g., privatelink.blob.core.windows.net) to Azure DNS or to a DNS forwarder that can resolve these records.
  • Client-Side DNS: Double-check the DNS settings on the client machines initiating the connection.
If nslookup returns an IP address that is not the private endpoint's IP, or if it times out, your DNS configuration is likely incorrect.

Private Endpoint Creation Failures

If your private endpoint creation fails:

  • Subnet Capacity: Ensure the target subnet has enough available IP addresses.
  • Permissions: Verify that the user or service principal creating the private endpoint has the necessary RBAC roles (e.g., Network Contributor) on the virtual network and the resource you are connecting to.
  • Resource ID: Double-check that the Resource ID of the target Azure service is entered correctly.
  • Resource Region: Private endpoints and their target services must be in the same region, or you must explicitly use global peering for some services.

Unable to Access Service After Successful Connection

If you can connect but cannot perform operations on the service:

  • Service Permissions: Ensure the identity connecting to the service has the appropriate permissions *within* that service (e.g., Storage Blob Data Contributor role for Azure Blob Storage).
  • Service Configuration: Review the specific service's configuration for any access policies or restrictions that might be blocking traffic originating from your private endpoint.
  • Resource Provider: Ensure the resource provider for the target service is registered in your subscription.

Further Assistance

If you've tried these steps and are still experiencing issues, please consult the Azure support documentation for your specific service or open a support ticket with Microsoft Azure. Provide as much detail as possible, including network traces and DNS resolution results.