Chapter 5 · Design and Implement Private Access to Azure Services·v2.0.0·Updated 6/3/2026·~9 min
What's changed: Deepened AZ-700 Chapter 5 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
5.2Choosing Between Service Endpoints and Private Endpoints
Key points
Understand the difference and selection between service endpoints (optimize PaaS access via the VNet) and private endpoints (assign a private IP), and touch on Private Link Service for offering your own service via Private Link.
There are two ways to control PaaS access: a private endpoint that assigns a private IP, and a service endpoint that optimizes the route and allows the VNet on the PaaS side.
5.2.1Difference between the two
- Service endpoint: optimize the route over the Azure backbone and allow the subnet on the PaaS firewall; no private IP is assigned.
- Private endpoint: assigns a private IP in the VNet; reachable from on-prem too and more strictly private.
- Selection: use a private endpoint when you need a private IP / on-prem reachability / strict isolation; a service endpoint when simply allowing a VNet is enough.
- Private Link Service: offer your own service (behind a Standard Load Balancer) to other tenants/VNets via Private Link.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.