This article is based on Microsoft’s original announcement of the Azure Private Link preview, originally reported by rcpmag.com in September 2019.
What Is Azure Private Link?
Azure Private Link is a Microsoft Azure networking service designed to keep connections to Azure platform-as-a-service (PaaS) resources entirely within Microsoft’s private backbone network. Rather than routing traffic over the public internet at any point, Private Link ensures that connections originate and remain inside an organization’s Azure Virtual Network (VNet).
The service was announced as a public preview in September 2019. At the time of the preview, it did not carry a service-level agreement (SLA) and was not recommended for production workloads.
Why Existing Options Were Not Enough
Before Azure Private Link, organizations had two main options for connecting to Azure services from their private networks:
- VNet Service Endpoints: These allow traffic to flow from a VNet directly to Azure services, but the PaaS endpoint is still served over a public IP address. This means the connection is not reachable from on-premises environments through Azure ExpressRoute private peering or a VPN gateway, because the traffic still touches a public endpoint at some stage.
- Azure ExpressRoute: ExpressRoute provides dedicated, high-bandwidth private connections to Azure. However, it is primarily positioned as a high-throughput connectivity solution rather than a general-purpose mechanism for keeping all Azure service traffic off the public internet.
Azure Private Link fills the gap for organizations that simply want to access Azure PaaS services without any public internet traversal, without necessarily needing the dedicated high-bandwidth circuit that ExpressRoute provides.
How Azure Private Link Works
Azure Private Link creates a private endpoint — a network interface with a private IP address — inside the customer’s VNet. Traffic destined for a supported Azure service is routed through this private endpoint and never leaves Microsoft’s backbone network. Key characteristics include:
- The connection is mapped to a specific PaaS resource (such as a particular storage account or SQL database instance), not to the entire service. This provides resource-level isolation.
- No need to configure route tables, Azure Network Security Groups, gateways, NAT devices, ExpressRoute connections, or VPN gateways for the private connection itself.
- Works across organizations with multiple Azure Active Directory tenancies.
- Supports overlapping IP address space across VNets, which is a common complication in large enterprise and multi-tenant architectures.
Exfiltration Protection
One of the security advantages Microsoft highlighted is data exfiltration protection. Because Private Link maps a private endpoint to a specific PaaS resource rather than the whole service, an attacker who gains access to the private endpoint cannot redirect traffic to a different account on the same service. Attempts to send data to a different storage account or SQL instance through the same private endpoint will fail, reducing the blast radius of a compromised connection.
Use Case: Service Providers and Azure Marketplace Partners
Azure Private Link is not limited to first-party Microsoft services. Microsoft also positioned it for use with customer-owned services and partner services.
Previously, service providers who needed to connect privately to a customer’s VNet could use VNet peering, but this approach has scalability limits and can lead to IP address conflicts as the number of peered networks grows. With Azure Private Link, service providers can place their service behind an Azure Standard Load Balancer and expose it as a Private Link service. Customers can then consume that service through a private endpoint in their own VNet.
Microsoft expressed confidence that a significant portion of future Azure Marketplace offerings would be delivered through Azure Private Link, enabling software-as-a-service (SaaS) solutions to be consumed privately within a customer’s own network — a capability that had been a common customer request.
Services Supported at Preview Launch
At the time the preview was announced, Azure Private Link supported the following Azure services:
- Azure Storage
- Azure Data Lake Storage Gen 2
- Azure SQL Database
- Azure SQL Data Warehouse
- Customer-owned services (via Standard Load Balancer)
Microsoft announced plans to extend support to additional services in the months following the preview, including:
- Azure Cosmos DB
- Azure Database for MySQL
- Azure Database for PostgreSQL
- Azure Database for MariaDB
- Azure App Service
- Azure Key Vault
- Partner services
Preview Limitations
As with all Azure previews, the initial release came with important caveats:
- No SLA: The preview did not include uptime guarantees and was not suitable for production workloads.
- Regional availability: The preview was constrained to specific Azure US regions, with availability varying depending on whether the target was a customer-owned resource or a Microsoft PaaS service.
- No pricing at launch: Pricing was not announced at the time of the preview.
Summary
Azure Private Link addresses a genuine gap in Azure’s networking options: the ability to connect to PaaS services from on-premises environments or private VNets without any traffic traversing the public internet. It simplifies firewall and network configuration compared to alternative approaches, adds meaningful data exfiltration protection through resource-level scoping, and opens a scalable path for service providers to deliver privately-connected offerings to their customers. Organizations evaluating Azure network security architecture should assess whether Private Link is now generally available for their required services, as the service has continued to expand well beyond the original preview scope.