AZ-700 · Domain 4 of 5

AZ-700 Domain 4: Design and implement private access to Azure services

Keeping traffic to Azure PaaS services off the public internet: planning and creating private endpoints, publishing your own Private Link service, integrating privatelink DNS zones and on-premises clients, and using service endpoints with endpoint policies.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
~6
Suggested study time estimate
5–7 hrs

About 10 min read Reviewed October 2026

Overview

Domain 4 is the smallest AZ-700 skill area but one of the most precise. Microsoft lists two functional groups. The Private Link group covers planning and creating private endpoints, configuring access to them, creating a Private Link service for your own application, integrating private endpoints with DNS, and letting on-premises clients reach Private Link resources.

The service endpoints group covers choosing when a service endpoint fits, creating service endpoints on subnets, configuring service endpoint policies and configuring access on the target service. The domain is mostly about one decision: a private endpoint gives the service a private IP inside your VNet, while a service endpoint keeps the public endpoint but lets the service recognize traffic from your subnet. DNS integration is where most real deployments and most exam questions go wrong.

How it's tested

Private access questions describe a PaaS resource such as a storage account or SQL database, the clients that need it, and a security rule such as no public exposure. You choose a private endpoint, service endpoint or Private Link service, then the DNS design that makes the choice work, including for on-premises clients.

  • Endpoint versus endpoint

    Requirements on public exposure, on-premises access and cost are given, and you choose a private endpoint or a service endpoint.

  • Make the name resolve

    Clients reach the public IP instead of the private one, and you fix the privatelink zone, link or forwarder.

  • Publish a service

    A provider wants consumers in other tenants to reach its app privately, and you pick Private Link service behind a Standard internal load balancer.

Reasoning it through

On-premises users connected through ExpressRoute must reach a storage account that has public network access disabled. Service endpoints only apply to traffic from Azure subnets, so they cannot help. A private endpoint gives the account a private IP reachable over private peering. On-premises DNS must then resolve the privatelink name to that IP, typically by forwarding to a DNS Private Resolver inbound endpoint. Both parts are required.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

4.1 Design and implement Azure Private Link service and Azure private endpointsPrivate endpoints, Private Link service, DNS integration and on-premises access.
What it means
This group covers planning and creating private endpoints for Azure PaaS resources, configuring access to them, creating a Private Link service to expose your own application behind a Standard internal load balancer, integrating Private Link and private endpoints with DNS, and integrating a Private Link service with on-premises clients.
What to understand
A private endpoint is a NIC with a private IP in your subnet mapped to one sub-resource, such as the blob service of one storage account. Public access can then be disabled on the resource. Clients must resolve the service name to the private IP, which Azure does through a CNAME to a privatelink zone such as privatelink.blob.core.windows.net that you host as a private DNS zone linked to the VNet. NSG and UDR support for private endpoints needs network policies enabled on the subnet. A Private Link service requires approval of each consumer connection unless auto-approval is set.
How it shows up
Expect a resolution failure, an on-premises access requirement, or a provider-consumer design asking what to deploy.
Common confusion
Linking the privatelink zone to the hub only and expecting spokes using Azure-provided DNS to resolve it.
4.2 Design and implement service endpointsSubnet-level service endpoints, endpoint policies and service firewall rules.
What it means
This group covers deciding when a service endpoint is appropriate, enabling service endpoints on a subnet for a service such as Microsoft.Storage or Microsoft.Sql, creating service endpoint policies to restrict which resources a subnet can reach, and configuring virtual network rules on the target service to allow the subnet.
What to understand
A service endpoint sends subnet traffic to the service over the Azure backbone and tags it with the subnet's identity, but the service keeps its public IP and DNS name. You must also add a virtual network rule on the resource firewall. Service endpoints are free and quick, yet they do not extend to on-premises or peered networks. Service endpoint policies, available for Azure Storage, limit a subnet to specific storage accounts, which helps prevent data exfiltration.
How it shows up
Expect a low-cost requirement to restrict a storage account to one subnet, or a request to block access to other storage accounts.
Common confusion
Believing a service endpoint gives the service a private IP; the endpoint stays public, only the route and source identity change.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Private endpoint

    A private IP in your VNet for one instance of a PaaS service.

    Remember
    Works from peered VNets and on-premises.
    Tested as
    Private access questions.
    Trap
    Expecting it to cover every sub-resource automatically.

  • Sub-resource

    The specific service part a private endpoint targets, such as blob, file or sqlServer.

    Remember
    Each sub-resource needs its own endpoint and zone.
    Tested as
    Storage design questions.
    Trap
    Creating one endpoint for blob and file.

  • privatelink DNS zones

    Private zones such as privatelink.database.windows.net that hold endpoint records.

    Remember
    Link the zone to every VNet that resolves through Azure DNS.
    Tested as
    DNS integration questions.
    Trap
    Overriding the public zone name instead.

  • On-premises resolution

    On-premises DNS forwards Azure zones to a resolver in Azure.

    Remember
    DNS Private Resolver inbound endpoint is the managed target.
    Tested as
    Hybrid access questions.
    Trap
    Pointing on-premises clients to 168.63.129.16 directly.

  • Network policies for private endpoints

    Subnet setting that lets NSGs and UDRs apply to private endpoints.

    Remember
    Disabled by default.
    Tested as
    Security questions.
    Trap
    Expecting NSG rules to filter endpoint traffic automatically.

  • Private Link service

    Your own service exposed privately behind a Standard internal load balancer.

    Remember
    Consumers connect with private endpoints.
    Tested as
    Provider scenarios.
    Trap
    Using a public load balancer.

  • Connection approval

    Private endpoint connections can need manual approval by the resource owner.

    Remember
    Auto-approval can list trusted subscriptions.
    Tested as
    Cross-tenant questions.
    Trap
    Assuming connections are always automatic.

  • Service endpoint

    Extends subnet identity to a PaaS service over the backbone.

    Remember
    The service keeps its public endpoint.
    Tested as
    Low-cost access questions.
    Trap
    Expecting on-premises traffic to use it.

  • Service endpoint policy

    Restricts subnet access to specific Azure Storage accounts.

    Remember
    Helps prevent exfiltration.
    Tested as
    Data protection questions.
    Trap
    Expecting it for every service type.

  • Virtual network rule

    Resource firewall entry that admits a subnet with a service endpoint.

    Remember
    Both the endpoint and the rule are needed.
    Tested as
    Configuration questions.
    Trap
    Enabling only the subnet side.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Private endpoint vs service endpoint

ConceptMeaningKey differenceCommon trap
Private endpoint Private IP for the resource in your VNet Reachable from peered and on-premises networks Forgetting DNS integration
Service endpoint Optimized route from a subnet to a public endpoint Free, Azure subnets only Thinking the endpoint becomes private
Service endpoint policy Allow list of storage accounts for a subnet Controls egress targets Using it for inbound control

Private Link roles

ConceptMeaningKey differenceCommon trap
Private endpoint (consumer) Consumer's NIC that connects to a service Lives in the consumer VNet Placing it in the provider VNet
Private Link service (provider) Provider's service behind an internal load balancer Exposes your own app Using it for Azure PaaS services

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Service endpoint for on-premises

    What candidates pick
    Enable a service endpoint so ExpressRoute users can reach storage privately.
    Why it looks right
    It sounds private and is cheaper.
    Why it's wrong
    Service endpoints apply only to traffic from Azure subnets; on-premises clients need private endpoints.

    Clue to watch for Clients are in a data center connected by VPN or ExpressRoute.

  2. Endpoint works without DNS

    What candidates pick
    Create a private endpoint and stop there.
    Why it looks right
    The endpoint gets a private IP immediately.
    Why it's wrong
    Clients still resolve the public address unless a privatelink zone or forwarder returns the private IP.

    Clue to watch for Connections still go to a public IP after deployment.

  3. Hosts file fix

    What candidates pick
    Add hosts file entries on each VM to reach the private endpoint.
    Why it looks right
    It works in a quick test.
    Why it's wrong
    Hosts files do not scale and break when IPs change; use private DNS zones and resolvers.

    Clue to watch for The scenario mentions many clients or least administrative effort.

  4. Policy for every service

    What candidates pick
    Apply a service endpoint policy to restrict SQL database access.
    Why it looks right
    Policies sound universal.
    Why it's wrong
    Service endpoint policies target Azure Storage; other services need different controls.

    Clue to watch for The service named is not Azure Storage.

  5. Private Link service for PaaS

    What candidates pick
    Create a Private Link service to reach an Azure SQL database.
    Why it looks right
    Both names contain Private Link.
    Why it's wrong
    Azure PaaS resources are reached with private endpoints; Private Link service publishes your own load-balanced app.

    Clue to watch for The target is a Microsoft-managed PaaS resource.

Answer framework

Use these steps to choose and complete a private access design for an AZ-700 scenario.

  1. Identify where clients live: Azure subnets only, peered VNets, other tenants or on-premises networks over VPN or ExpressRoute.
  2. If public exposure must end or clients include on-premises or peered networks, choose a private endpoint; for Azure subnets with low cost, consider a service endpoint.
  3. For private endpoints, create the privatelink zone, link it to every resolving VNet, and add on-premises forwarding to a resolver inbound endpoint.
  4. For service endpoints, enable the endpoint on the subnet, add the virtual network rule on the resource, and add a storage endpoint policy when exfiltration matters.
  5. When you publish your own app, use a Private Link service behind a Standard internal load balancer and plan connection approval.

Practice question

A storage account must be reachable only from VMs in a hub VNet, two peered spoke VNets and an on-premises network connected by ExpressRoute private peering. Public network access will be disabled. What should you implement?

Want more like this? The AZ-700 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain is small enough to master in a few focused sessions, so aim for full marks. Start in a lab with one storage account. Enable a service endpoint and a virtual network rule, test access, then disable public access and see it fail. Next, create a private endpoint for the blob sub-resource with automatic private DNS integration and run nslookup from a VM to watch the CNAME chain resolve to the private IP.

After that, simulate a spoke that uses custom DNS and confirm resolution breaks until the zone link or forwarding is fixed. Read the Microsoft Learn private endpoint DNS guidance until you can describe the on-premises forwarding path with DNS Private Resolver from memory.

Finally, study Private Link service: the internal load balancer requirement, NAT IPs, visibility and approval. Practice questions here often combine Domain 1 DNS skills with Domain 4 choices, so review both domains together in the same week.

FAQ

How much of AZ-700 is Domain 4, Design and implement private access to Azure services?

Microsoft weights it at 10–15%, the smallest skill area, with two functional groups: Private Link with private endpoints, and service endpoints.

Can on-premises clients use service endpoints?

No. Service endpoints apply to traffic from Azure subnets. On-premises clients need a private endpoint reached over VPN or ExpressRoute.

Why does my private endpoint resolve to a public IP?

The client is not using a DNS path that includes the privatelink zone. Link the zone to the VNet or configure forwarding to a resolver that can see it.

What does a Private Link service require?

A Standard internal load balancer in front of your application, plus NAT IP configuration in the provider subnet.

Do service endpoints cost money?

No. Service endpoints are free; private endpoints are charged per hour and per GB processed.

Which services support service endpoint policies?

Service endpoint policies are designed for Azure Storage, letting a subnet reach only the storage accounts you list.

Other Networking certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered private endpoints, Private Link service, DNS integration and service endpoints. Test whether you can pick and complete the right private access design.

Take the AZ-700 practice test Check your AZ-700 readiness

Keep going