Before Lab 2.5 — Protecting Key Vault with a Private Endpoint
Before Lab 2.5 — Protecting Key Vault with a Private Endpoint
In Lab 2.4 you moved the DB storage account behind a private endpoint. Key Vault holds secrets — it gets the same treatment.
Why Key Vault needs a private endpoint
Key Vault is publicly reachable by default at https://<vault-name>.vault.azure.net. Anyone with valid credentials — or a leaked credential — can query secrets from anywhere on the internet.
The same principle applies as with the DB storage account:
Authentication controls who can access a secret.
Network controls who can even try.What changes with a private endpoint
Key Vault gets a private IP inside the VNet. The DNS zone privatelink.vaultcore.azure.net resolves the vault hostname to that IP for resources inside the VNet, and public access can then be disabled.
The AzureServices bypass
Key Vault has a network ACL bypass that the DB storage account does not: when bypass = "AzureServices" is set, Azure-native services using managed identity can reach Key Vault through the Azure backbone even with public access denied — but only when there is no private endpoint. Once a private endpoint exists, traffic routes through it instead.
Info
The bypass is a safety net, not a substitute for a private endpoint. It does not prevent access from non-Azure networks. A private endpoint with public access disabled is the more explicit and robust boundary.
Private DNS zone reference
| Service | Private DNS zone |
|---|---|
| Table Storage | privatelink.table.core.windows.net |
| Key Vault | privatelink.vaultcore.azure.net |
| Storage (blob) | privatelink.blob.core.windows.net |
Each zone must be linked to the VNet for name resolution to work.
Integrate with private DNS zone
When the Portal wizard asks whether to Integrate with private DNS zone, leave it checked.
Azure creates the zone, adds the A record, and links it to the VNet automatically. If you uncheck it and skip this step, the vault hostname still resolves to the public IP and the private endpoint is not used — even though its connection status shows Approved.