A private endpoint lets your VM talk to Azure services like Storage, SQL, or Key Vault over a private IP inside your VNet — never touching the public internet.
Normally when your application connects to an Azure service (e.g. Azure Blob Storage), the hostname resolves to a public IP address and traffic flows over the internet — even if both your VM and the storage account are in Azure.
A Private Endpoint is a virtual network interface card (NIC) that Azure injects
directly into your VNet subnet. It gets a private IP from your address space
(e.g. 10.0.0.10).
Azure Private DNS then overrides the public hostname so it resolves to this private IP instead.
Your app connects normally — zero code changes — but traffic never leaves Microsoft's backbone.
Azure injects a NIC with a private IP into your subnet. That's the "endpoint" — a door into the service.
Overrides public DNS so the service hostname resolves to the private IP, not a public one.
Traffic stays entirely on Microsoft's private backbone — never exposed to the public internet.
Your app still uses the same hostname. DNS does the magic silently in the background.
Your Linux VM queries mystore.blob.core.windows.net — same as always.
Instead of returning a public IP like 52.x.x.x, the private DNS zone returns 10.0.0.10 — the private endpoint's IP inside your VNet.
The connection goes to 10.0.0.10 — the virtual NIC sitting inside your subnet. No public route is involved at all.
Azure maps the private endpoint NIC to the actual storage account behind the scenes, over Microsoft's private backbone. Traffic never hits the internet.