Securing PaaS Resources on Azure Service Endpoints or Private Endpoints

Introduction

Securing connectivity to Platform-as-a-Service (PaaS) resources like Azure Storage, SQL Database, or Key Vault is critical when building applications on Azure. By default, these services are exposed over public IPs, which means traffic can flow over the public internet, even if authentication controls are enabled.

Azure provides two main approaches to restrict access: Service Endpoints and Private Endpoints. While many blogs simply define them, in this article, we’ll go hands-on with both options, using Azure CLI commands, and compare them in terms of configuration, security, and cost.

Why Securing Azure PaaS Services Is Critical?

Enterprises often handle sensitive workloads such as financial data, customer records, or intellectual property. Allowing these services to be accessible publicly (even with strong authentication) creates risks:

• Exposure to brute force or DDoS attacks.
• Compliance violations for industries like finance or healthcare.
• Unintended access from outside the corporate environment.

The goal is simple: restrict access so only your trusted network can reach your PaaS services.

Service Endpoint vs Private Endpoint

Service Endpoint: Extends your VNet’s private IP space to Azure PaaS services. The PaaS service still has a public IP, but access is locked down to your VNet/subnet.

• Easy to configure.
• No extra cost.

Private Endpoint: Creates a private IP inside your VNet for the PaaS service. This provides a direct NIC interface to the service, fully isolating it from the public internet.

• Strongest security, traffic stays within your private VNet.
• Supports on-premises and cross-region access.

Step-by-Step Guide

Step 1: Create an Azure Storage Account

We will use a Storage Account as our target PaaS service.

# Create Resource Group

# Create Storage Account

Step 2: Create a VNet and VM for Testing

# Create VNet with subnet

# Create a test VM

You now have a Storage Account and a VM inside a VNet for testing.

Step 3: Configuring Service Endpoint

First, let’s enable Service Endpoint for Azure Storage on our subnet.

# Enable Service Endpoint for Storage

# Restrict access to Service Endpoint

Step 4: Testing Service Endpoint

SSH into the VM and try accessing Azure Blob storage:

# SSH into VM

# Inside VM, test storage access

If everything is configured, the request succeeds. Access is blocked from outside the VNet.

Step 5: Configuring Private Endpoint

Now, let’s try the Private Endpoint approach.

# Create Private Endpoint

You’ll also need a Private DNS Zone for name resolution:

# Create DNS zone

# Add DNS record for Storage

Step 6: Testing Private Endpoint

From inside the VM:

# Resolve DNS

# Should return a private IP like 10.0.1.5

# Test access again

Now your Storage Account traffic flows entirely over private IP. The service is not reachable from the public internet.

Conclusion

Both Service Endpoints and Private Endpoints are important in securing Azure PaaS resources. Service Endpoints are quick, free, and easy, ideal for development and less sensitive workloads. Private Endpoints, while more complex and slightly costlier, deliver true network isolation that many production environments demand.

By walking through CLI steps and testing connectivity, we’ve seen how each option behaves in practice. When designing your Azure architecture, balance cost vs security, and choose the right endpoint model for your workload.

Drop a query if you have any questions regarding Service Endpoints or Private Endpoints and we will get back to you quickly.

About CloudThat