Microsoft Previews Azure Private Link for Service Connections

Microsoft on Tuesday announced a preview of Azure Private Link, an option for keeping Azure service connections off the public Internet.

With Azure Private Link, connections to Azure platform-as-a-service (PaaS) solutions happen via Microsoft's private backbone network, rather than the public Internet. The connection stays within an organization's virtual network, or "VNet" (see diagram):

[Click on image for larger view.] Private connection to Azure services using Azure Private Link. (Source: Microsoft's Azure product page)

It's true that organizations today can connect to Azure's multitenant services using VNet service endpoints, but the public Internet still gets used at some point. Microsoft's announcement explained that when an organization uses VNet service endpoints, "the PaaS endpoint is still served over a public IP address and therefore [is] not reachable from on-premises [environments] through Azure ExpressRoute private peering or VPN gateway."

The Azure ExpressRoute service is yet another way for organizations to have private Internet connections when connecting to Azure services, but it's typically billed as a solution for getting high-bandwidth connections. In contrast, Azure Private Link appears to be a solution for organizations that just don't want to touch the public Internet when accessing Azure services.

Partner Support
Microsoft is also touting Azure Private Link for use with "customer-owned services," as well as "partner services."  Service provider partners using Azure today can use VNet peering to establish a private connection to a customer's VNet, "but it is not scalable and will soon run into IP address conflicts," Microsoft's announcement explained. These service providers can instead run Azure Private Link behind an Azure Standard Load Balancer to create these private connections, Microsoft explained in this Azure article.

Microsoft sees Azure Private Link as something that its partners offering solutions through the Azure Marketplace likely will use in the near future. Here's how Microsoft's announcement expressed it:

The ability to consume the SaaS solutions privately within the customer's own network has been a common request. With Azure Private Link, we're extending the private connectivity experience to Microsoft partners. This is a very powerful mechanism for Microsoft partners to reach Azure customers. We're confident that a lot of future Azure Marketplace offerings will be made through Azure Private Link. 

Microsoft also is promising that Azure Private Link will simplify corporate firewall configurations. It won't require configuring "route tables and Azure Network Security Groups." It doesn't require the use of "gateways, NAT [Network Address Translation] devices, ExpressRoute or VPN connections gateways," according to an Azure product page description. It'll also work for organizations having multiple Active Directory tenancies.

Microsoft is also touting the benefit of "exfiltration protection" with Azure Private Link. For instance, Azure Private Link maps to particular PaaS resources instead of the whole service, and therefore malicious attempts to send data to a different account on the same private endpoint "will fail," Microsoft explained. Lastly, the use of "overlapping IP address space" in VNets is supported.

Preview Limitations
The preview of Azure Private Link currently just supports some Azure services right now, namely "Azure Storage, Azure Data Lake Storage Gen 2, Azure SQL Database, Azure SQL Data Warehouse and customer-owned services," according to this Azure article.

In "coming months," Microsoft plans to add Azure Private Link support for "Azure Cosmos DB, Azure MySQL, Azure PostgreSQL, Azure MariaDB, Azure Application Service, and Azure Key Vault, and Partner Services," Microsoft's announcement noted.

The preview lacks service-level agreement uptime guarantees, and shouldn't be used for production workloads, Microsoft warned in its overview document. It's also constrained right now for use in certain Azure U.S. regions, depending on whether it's used to access customer-owned resources or Azure PaaS services, as described in that document. Pricing is nonexistent right now.

If Microsoft's documentation isn't enough, Aidan Finn, a Microsoft Most Valuable Professional and Azure expert, talks about these connection options in this blog post.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.


  • Microsoft Hires Movial To Build Android OS for Microsoft Devices

    Microsoft has hired the Romanian operations of software engineering and design services company Movial to develop an Android-based operating system solution for the Microsoft Devices business segment.

  • Microsoft Ending Workflows for SharePoint 2010 Online Next Month

    Microsoft on Monday gave notice that it will be ending support this year for the "workflows" component of SharePoint 2010 Online, as well as deprecating that component for SharePoint 2013 Online.

  • Why Windows Phone Is Dead, But Not Completely Gone

    Don't call it a comeback (because that's not likely). But as Brien explains, there are three ways that today's smartphone market leaves the door open for Microsoft to bring Windows back to smartphones.

  • Feature Update Deferral Mix-Up in Windows 10 Version 2004 Further Explained

    Microsoft last week described the confusion it is attempting to avoid by removing the client graphical user interface (GUI)-based controls to defer Windows 10 feature updates, starting with version 2004.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.