Public and Private Endpoints
😟 THE PROBLEM
Your database and storage can be reached from anywhere on the internet.
😊 THE SOLUTION
Connect through private endpoints and switch off public access.
- Data services exposed to the internet✓ Private IP in your VNet
- Traffic crosses public networks✓ Stays on Microsoft’s backbone
- Office needs private access✓ Reach it over VPN or ExpressRoute
Quick answer
A public endpoint is a service's address reachable over the internet, using a public IP or URL. A private endpoint is a network interface with a private IP address from your virtual network that connects you privately to an Azure service such as Storage or SQL Database, using Azure Private Link. Traffic stays on the Microsoft network, and you can turn off public access completely.
Exam objective: 2.2.6 Define public and private endpoints. (Skills measured as of July 20, 2026)
Start with a question
Your database is in the cloud. Should anyone on the internet be able to knock on its door?
Ideally not. A private endpoint moves the door inside your private network.
Explain it like I’m 10
The technical explanation
PaaS services (Storage, SQL Database, Key Vault and many more) have public endpoints by default. A private endpoint creates a network interface in your subnet with a private IP, mapped to one specific resource through Azure Private Link. Combine it with private DNS zones and disable public network access for strong isolation.
Real-world business scenario
A fintech company
- The problem
- Security scans flagged that its storage accounts and SQL database were reachable from the internet.
- What they used
- Private endpoints for storage and SQL, private DNS zones, and public network access disabled.
- Why that choice
- Services become reachable only from the company's networks.
- The result
- The internet-facing attack surface for data services dropped to zero.
When to use it and when not to
✓ Use it when…
- Sensitive data services such as databases, storage and Key Vault.
- Hybrid access from on-premises over VPN or ExpressRoute.
✕ Think twice when…
- Public websites meant for everyone, which need a public endpoint.
Interview preparation
Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.
Beginner What is the difference between a public and a private endpoint?
Model answer
A public endpoint can be reached from the internet. A private endpoint gives the service a private address inside my virtual network, so only my network can reach it.
Intermediate Why would you use a private endpoint for Azure SQL Database?
Model answer
To keep database traffic off the internet, to disable public access entirely and reduce the attack surface, and to let on-premises networks reach the database privately over VPN or ExpressRoute.
Experienced developer What extra configuration do private endpoints need?
Model answer
DNS. Use private DNS zones so the service's normal hostname resolves to the private IP inside the VNet and from connected networks. Then disable public network access, and review NSG and routing policies for the private endpoint subnet.
Test yourself with exercises
3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.
Quick revision
Key points
- Public endpoint = reachable over the internet.
- Private endpoint = private IP in your VNet, via Private Link.
- Private endpoints keep traffic on the Microsoft network.
- You can disable public access once private endpoints are in place.
Important terminology
- Public endpoint
- An internet-reachable address for a service.
- Private endpoint
- A network interface with a private IP in your VNet that connects to a PaaS service.
- Azure Private Link
- The technology behind private endpoints that keeps traffic on the Microsoft backbone.
Common mistakes
- Forgetting DNS configuration for private endpoints.
Exam tips
- "Access a PaaS service using a private IP from your VNet" = private endpoint.
Five quick revision questions
-
1.What is a public endpoint?Show
An internet-reachable address for a service.
-
2.What does a private endpoint use?Show
A private IP address from your virtual network.
-
3.Which technology powers private endpoints?Show
Azure Private Link.
-
4.Can you block public access after adding a private endpoint?Show
Yes.
-
5.What usually needs to be configured with private endpoints?Show
Private DNS zones.
Official references
Finished this lesson? Tick it off. Your progress is saved in this browser.