Secure Azure traffic with private network paths

Azure networking is not one switch between public and private. A production path can include user access, service-to-service traffic, control-plane calls, data-plane calls, name resolution, and outbound dependencies. Secure each path against its purpose.

Microsoft defines an Azure private endpoint as a network interface with a private IP address from a virtual network. It connects to a specific service resource through Azure Private Link. The private endpoint overview is the current source for supported resources and connection behaviour.

Private endpoint and public access are separate controls

A private endpoint adds a private route to the target service. Microsoft notes that it does not necessarily restrict the service’s public network access. Apply the service-specific public-access setting or firewall policy separately when the design requires private-only access.

Also select the correct target subresource. Azure Storage, for example, can require separate endpoints for blob, file, queue, table, web, or Data Lake Storage paths.

DNS decides which path the client takes

The normal service name must resolve to the private endpoint’s private IP from the approved network. Configure the relevant private DNS zone and its virtual-network links, then test resolution from each client location.

Do not validate only with the portal. Test the fully qualified domain name from the application runtime, integration runtime, build agent, administrator path, and on-premises network where applicable.

Databricks has more than one Private Link direction

Azure Databricks documents separate Private Link patterns:

• inbound connectivity from users to workspace and account resources;
• outbound connectivity from serverless compute to customer resources;
• classic compute connectivity to the Databricks control plane.

These patterns can be enabled independently or combined. Select the endpoints, workspace settings, DNS, and network connectivity configuration that match the traffic being protected.

The diagram is retained as a historical topology. Current Databricks endpoint types and prerequisites are more detailed than the 2021 article showed.

Validate the full path

Before release, test:

1. DNS resolves to the intended private IP;
2. the private-endpoint connection is approved;
3. the required target subresource is present;
4. public access behaves as designed;
5. identity and resource permissions still apply;
6. routes, firewalls, and network security groups allow only required traffic;
7. monitoring captures both allowed and denied paths.

A private IP is one piece of the control. The evidence comes from testing the application path end to end.