PrivateLink

With so-called PrivateLink DNS entries, Azure PaaS services can be used as if they were in their own Virtual Network in Azure.

A Private Endpoint is created in this network, which receives an IP address within the network. Communication with the service within the network is then possible via this endpoint.

Since the endpoint's IP address does not have to be static, communication with the service is established via a DNS name. This is stored in a special DNS zone in Azure.

The following steps are processed sequentially:

1. A user creates a private endpoint for a service in Azure.
2. A policy detects this and creates the corresponding DNS entries in the central DNS zone.

Private Key Vault

The following guide describes the creation of a private Key Vault within a Virtual Network in Azure.

1. Log in to the Portal.
2. Enter Key Vaults in the global search field and select the Key Vaults service.
3. Click Create.
4. Enter the details for the Key Vault.
5. Under the Networking tab, configure the following settings:
   • Disable the checkbox Enable Public Access.
   • Click Create a private endpoint.
   • Select the virtual network in which the private endpoint should be created.
   • Disable the box Integrate with private DNS Zone.
6. Click Review + create and then Create.

The Key Vault will have a private IP address in the address range of the virtual network after creation. This can be checked via DNS using the terminal.

dig [Name of the Key Vault].vault.azure.net