A water-lab subnet must reach Storage on the Azure backbone, and a reviewer asks whether a Service Endpoint makes the account private. What should the security engineer explain?
Select an answer to reveal the explanation.
Short Explanation
Service Endpoint is the backbone express lane—not a private mailbox. Traffic leaves from your VNet on Microsoft’s network, but Storage still wears a public VIP. Private Endpoint is the private-IP story.
Full Explanation
A virtual-network Service Endpoint for Microsoft.Storage keeps traffic on the Microsoft backbone and sources it from the VNet identity, but the storage account continues to use a public VIP. That is not the same as a Private Endpoint, which places a private IP NIC in the subnet. Service Endpoints do not replace data-plane credentials or remove the need for the storage firewall’s VNet grants. Private DNS privatelink zones are required for Private Endpoint name resolution, not for enabling a Service Endpoint.