A water-lab subnet must reach Storage on the Azure backbone, and a reviewer asks whether a Service Endpoint makes the account private. What should the security engineer explain?
Select an answer to reveal the explanation.
Short Explanation
Service Endpoint is the backbone express lane—not a private mailbox. Traffic leaves from your VNet on Microsoft’s network, but Storage still wears a public VIP. Private Endpoint is the private-IP story.
Full Explanation
A virtual-network Service Endpoint for Microsoft.Storage keeps traffic on the Microsoft backbone with a source from the VNet identity, but the storage service still presents a public VIP—Service Endpoint does not make the account “private” the way a Private Endpoint’s private IP does. Explain that distinction to the water-lab reviewer.
Claiming a Service Endpoint assigns the storage account a private IP inside the subnet identical to a Private Endpoint fails by concept. Claiming Service Endpoints replace storage account keys and remove the need for any resource firewall fails. Claiming Service Endpoints work only when a privatelink DNS zone is linked first confuses Service Endpoints with Private Link DNS.
Exam caveat: Service Endpoint vs Private Endpoint is a high-frequency AZ-500 comparison. Operational check: enable the Service Endpoint, grant the VNet on the storage firewall, test backbone path behavior, and document that private IP isolation still requires Private Endpoint if mandated. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.