Before Lab 2.4 — Private Endpoints and the Data Layer
Before Lab 2.4 — Private Endpoints and the Data Layer
In Lab 2.4, you will move the internal backend's data storage toward private access using a private endpoint.
Covered in theory
Private Endpoints, Private DNS Zones, and how they compare to Service Endpoints are explained in the Service Endpoints vs Private Endpoints theory page.
Read that page if you have not done so yet before continuing.
Why Table Storage instead of Cosmos DB?
The original design used Cosmos DB as the data layer. Cosmos DB is unavailable in West Europe on Visual Studio subscriptions due to regional capacity exhaustion, and quota increases are not available for test environments.
Azure Table Storage provides an identical private endpoint story (privatelink.table.core.windows.net, sub-resource table) and is already part of the Azure Storage service. A dedicated storage account — separate from the frontend static website account — is used so each resource has a single responsibility and can be independently locked down.
Cosmos DB in production: Cosmos DB is a common choice for globally distributed, low-latency workloads. It supports private endpoints in the same way — sub-resource Sql (or MongoDB, Cassandra, etc. depending on the API), and a private DNS zone privatelink.documents.azure.com. The concepts you practice in this lab apply directly to Cosmos DB.
The Table Storage problem
The DB storage account has a public endpoint by default:
https://<account-name>.table.core.windows.netEven with authentication and authorization, the endpoint is exposed to the entire internet. A leaked access key or a misconfigured RBAC assignment can be exploited from anywhere.
After a private endpoint is created, the application connects through the VNet instead of the public internet. Public network access can then be disabled entirely — the application keeps working, only the public path is removed.
Integrate with private DNS zone
When the Portal wizard asks whether to Integrate with private DNS zone, leave it checked.
This creates the zone privatelink.table.core.windows.net, adds the A record that maps the storage hostname to its private IP, and links the zone to your VNet. Without it the application continues to resolve the hostname to the public IP and the private endpoint is bypassed.