Zero Trust networking assumes no location is automatically trusted. Authenticate and authorize identities, minimize reachable paths, inspect where justified, encrypt traffic, and monitor continuously. Private Link gives supported services private endpoint IPs. Private DNS resolves service names privately. Azure Firewall controls network flows. DDoS Protection and WAF address different attack layers.
A private endpoint is a network interface in your subnet mapped to a supported service subresource. Clients still use the service hostname. DNS inside trusted networks must resolve it to the private IP. The service's public network access should then be restricted or disabled according to the design.
Private IP connectivity does not grant data access. The caller still needs Entra/RBAC or service authorization.
Create the service-specific privatelink zone documented by Microsoft, link it to the hub/spoke VNets that need resolution, and register the private endpoint record. For hybrid clients, use DNS Private Resolver inbound endpoints and conditional forwarding from on-premises DNS. Avoid linking duplicate conflicting zones across spokes.
Test from the actual client:
Confirm it returns the intended private IP and that HTTPS uses the normal service hostname for certificate validation.
Azure Firewall is a managed stateful network security service with network/application rules, threat intelligence, DNS proxy, TLS inspection in supported premium scenarios, and centralized policy. Route intended flows through it; merely deploying a firewall does nothing.
Use Firewall Policy with rule collection groups, least-privilege destination FQDNs/service tags/IPs, and explicit priority. Log denies and allows needed for operations. TLS inspection has certificate, privacy, compatibility, and performance consequences.
A private endpoint can reduce internet exposure for a backend, while a public web application still needs a protected edge.
For every flow record:
“Allow the whole VNet” is rarely sufficient evidence.
For a storage Blob endpoint, both modules below connect an existing account and subnet to the required private DNS zone. Keep the storage public endpoint disabled only after the private DNS and client path pass testing.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Production modules should also create resolver endpoints/rulesets, firewall policy/rules, route tables, DDoS plan associations, diagnostics, and alerts where the architecture requires them. Use policy to audit public endpoints and roll out through a test spoke with connection tests.