Private endpoints and private DNS — zone names per service, resolution paths, links, fallback, approval and network policies
How a private endpoint works end to end — the privatelink CNAME and the private DNS zone for each common service, zone groups, VNet links, custom DNS forwarding to 168.63.129.16, Private Resolver for on-premises, NxDomainRedirect fallback, connection approval and its roles, subnet network policies, and endpoint limits.
markdownreferencev1Z447-M4P9stage: designtrust: officialservice: networkinginterface: iacinterface: cliprivate endpoint DNSprivatelink.blob.core.windows.netprivatelink.vaultcore.azure.netprivatelink.azurecr.iodata.privatelink.azurecr.ioprivatelink.database.windows.netprivatelink.documents.azure.comprivatelink.postgres.database.azure.comprivatelink.mysql.database.azure.comprivatelink.redis.azure.netprivatelink.azurewebsites.netscm.privatelink.azurewebsites.netprivatelink.azurecontainerapps.ioprivatelink.servicebus.windows.netprivatelink.openai.azure.comprivatelink.cognitiveservices.azure.comprivatelink.services.ai.azure.comprivatelink.search.windows.netprivatelink.azconfig.ioprivatelink.monitor.azure.comprivate DNS zone groupvirtual network link168.63.129.16 forwarderAzure DNS Private ResolverresolutionPolicy NxDomainRedirectprivate endpoint approval PendingprivateEndpointConnectionsApprovalNetwork Contributor subnets/join/actionPrivate DNS Zone Contributorprivate endpoint limit 1000 per VNetgroupId sub-resource
Private endpoints and private DNS
A private endpoint is a NIC with a private IP for one resource and one sub-resource (groupId). Clients keep using the normal hostname (<acct>.blob.core.windows.net): once the endpoint exists, public DNS returns a CNAME to <acct>.privatelink.blob.core.windows.net, and a private DNS zone for privatelink.blob.core.windows.net, linked to the client's VNet, answers that name with the private IP. Without the zone link the same CNAME resolves to the public IP, and a service with public access disabled answers 403.
Zones for common services (global Azure)
Service (groupId) | Private DNS zone(s) |
|---|---|
Storage blob, dfs, file, queue, table, web | privatelink.blob.core.windows.net, privatelink.dfs.core.windows.net, privatelink.file.core.windows.net, privatelink.queue.core.windows.net, privatelink.table.core.windows.net, privatelink.web.core.windows.net |
Key Vault vault | privatelink.vaultcore.azure.net |
Container Registry registry | privatelink.azurecr.io and {region}.data.privatelink.azurecr.io |
Azure SQL sqlServer | privatelink.database.windows.net |
Cosmos DB Sql | privatelink.documents.azure.com |
| PostgreSQL / MySQL flexible server | privatelink.postgres.database.azure.com / privatelink.mysql.database.azure.com |
Azure Managed Redis redisEnterprise; Azure Cache for Redis redisCache | privatelink.redis.azure.net; privatelink.redis.cache.windows.net |
App Service and Functions sites | privatelink.azurewebsites.net (and scm.privatelink.azurewebsites.net) |
Container Apps environment managedEnvironments | privatelink.{regionName}.azurecontainerapps.io |
Service Bus, Event Hubs namespace | privatelink.servicebus.windows.net |
Foundry Tools / Azure OpenAI account | privatelink.cognitiveservices.azure.com, privatelink.openai.azure.com, privatelink.services.ai.azure.com |
AI Search searchService; App Configuration configurationStores | privatelink.search.windows.net; privatelink.azconfig.io |
| Azure Monitor private link scope | privatelink.monitor.azure.com plus the opinsights and agent zones |
The full list, and the zones for other clouds, is Microsoft's "Azure Private Endpoint DNS zone values" page. One zone per name, shared by every VNet: create each zone once (usually in a hub subscription) and link it to every VNet that resolves it; two zones with the same name in different places split resolution.
Making DNS answer correctly
- Zone group on the endpoint (
privateDnsZoneGroups): Azure writes the A records, updates them when the endpoint changes, and deletes them with the endpoint. Up to five zones per group, one zone per name. Without it you script the records yourself. - VNet link (
privateDnsZones/virtualNetworkLinks) from the zone to each client VNet,registrationEnabled: false. A peered VNet needs its own link: default resolution doesn't cross peerings. - Custom DNS servers in the VNet must forward to Azure DNS, 168.63.129.16, from inside a VNet linked to the zones. Conditional forwarders name the public zone (
blob.core.windows.net,database.windows.net), not theprivatelink.one. - On-premises clients: an Azure DNS Private Resolver inbound endpoint (or a DNS server VM) in a linked VNet, with on-premises conditional forwarders pointing at it.
- NXDOMAIN inside the VNet for a name that resolves publicly: the linked privatelink zone has no record for it (for example a second storage account whose endpoint lives in another zone). Add the record through a zone group, or set the link's
resolutionPolicy: NxDomainRedirect(privatelink zones only), which falls back to public resolution. Negative answers are cached for a few minutes after a fix. - Some clients also query AAAA: a private endpoint answers A only.
Approval, roles and network policies
- A connection is auto-approved when the creator has
privateEndpointConnectionsApproval/actionon the target (for example Storage Account Contributor, Key Vault Contributor, SQL Server Contributor, DocumentDB Account Contributor). Otherwise, or across tenants, it stays Pending until the resource owner approves it (az network private-endpoint-connection approve). Endpoints created by Front Door Premium, App Service, Synapse or Data Factory managed VNets always need approval on the target. - The creator needs
Microsoft.Network/privateEndpoints/writewhere the endpoint goes,Microsoft.Network/virtualNetworks/subnets/join/actionon the subnet (Network Contributor), and Private DNS Zone Contributor on the zone for the zone group. - The endpoint's subnet must not be delegated.
privateEndpointNetworkPolicies(Disabledby default) decides whether NSGs and UDRs apply to endpoints:reference/networking/nsgs-and-routes.md. - Limits: about 1,000 private endpoints per VNet (more needs the High Scale feature), and one Private Link Service per load balancer frontend IP. Read your counts; don't design to the edge.
Errors: reference/networking/errors.md. Bicep for one endpoint with its zone: patterns/private-endpoint-for-paas.md. Database-specific network modes (PostgreSQL and MySQL private access vs endpoints, SQL Redirect ports): patterns/app-to-database-with-managed-identity.md.