What's changed: Deepened AZ-700 Chapter 5 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
5.2Choosing Between Service Endpoints and Private Endpoints
Understand the difference and selection between service endpoints (optimize PaaS access via the VNet) and private endpoints (assign a private IP), and touch on Private Link Service for offering your own service via Private Link.
There are two ways to control PaaS access: a private endpoint that assigns a private IP, and a service endpoint that optimizes the route and allows the VNet on the PaaS side.
5.2.1Difference between the two
- Service endpoint: optimize the route over the Azure backbone and allow the subnet on the PaaS firewall; no private IP is assigned.
- Private endpoint: assigns a private IP in the VNet; reachable from on-prem too and more strictly private.
- Selection: use a private endpoint when you need a private IP / on-prem reachability / strict isolation; a service endpoint when simply allowing a VNet is enough.
- Private Link Service: offer your own service (behind a Standard Load Balancer) to other tenants/VNets via Private Link.
Common on AZ-700: assigns a private IP, reachable from on-prem = private endpoint, no private IP, allow VNet on PaaS side, route optimization = service endpoint, offer your own service via Private Link = Private Link Service. If on-prem private reachability is required, choose a private endpoint.
Service endpoints suit optimizing access from Azure VNets and don’t provide on-prem→PaaS private reachability; if on-prem is in scope, use a private endpoint.
The two work fundamentally differently. A service endpoint is enabled on a subnet and passes that VNet/subnet’s identity to the PaaS, so the PaaS firewall’s virtual network rule can “allow only this VNet.” Traffic still goes to the PaaS public endpoint, but the route is optimized over the Azure backbone—no DNS change, no extra charge. A private endpoint, by contrast, assigns a real private IP in the VNet and reaches the PaaS without its public endpoint, so it’s privately reachable from on-prem and peered VNets too and lets you fully disable public access. For exfiltration control, service endpoints can’t fully prevent sending to “your other tenant’s storage,” so a private endpoint plus disabled public access is the stricter recommendation. Private Link Service, for offering your own app externally via Private Link, requires a Standard Load Balancer behind it, with consumers connecting via private endpoints. If requirements include on-prem private reachability or fully cutting the public path, choose a private endpoint without hesitation.
| Aspect | Service endpoint | Private endpoint |
|---|---|---|
| Private IP | Not assigned | Assigned in the VNet |
| Target | PaaS public endpoint (optimized route) | Private IP (avoids public path) |
| From on-prem | No | Yes (via VPN/ER) |
| Billing | No extra charge | Endpoint + data processed |
Scenario: use Storage only from Azure VNets with no extra cost (no on-prem). → Enable a service endpoint and allow the subnet on the Storage firewall. Conversely, if you must use it privately from on-prem and fully cut the public path, choose a private endpoint plus disabled public access.
FAQ: Q. Does a service endpoint still use the public path? → A. Yes—the target is still the PaaS public endpoint; only the route is optimized and the VNet is allowed. Full cutoff needs a private endpoint plus disabled public access. Q. Which is stronger for exfiltration control? → A. Private endpoint plus disabled public access is stricter.
Trap: “a service endpoint assigns a private IP to the PaaS” is wrong—that’s a private endpoint. Also “a service endpoint gives on-prem private reachability to the PaaS” is wrong—on-prem reachability is a private endpoint’s role.
5.2.2Section summary
- Private endpoint = private IP, on-prem reachable, service endpoint = no IP, allow VNet
- Offer your own service via Private Link = Private Link Service
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which optimizes the route and allows the subnet on the PaaS firewall without assigning a private IP?
Q2. You also need private reachability to the PaaS from on-premises. Which do you choose?
Q3. You want to offer your own service (behind a Standard Load Balancer) to other VNets/tenants via Private Link. What do you use?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.