A partner subscription created a Private Endpoint toward the canal authority’s SQL logical server, and the connection sits at Pending. What should the data-plane owner do?
Select an answer to reveal the explanation.
Short Explanation
Partner PE stuck on Pending? You own the approve/reject button on the SQL resource. Don’t punch their public IP into the firewall just to dodge that control.
Full Explanation
Private Endpoint connections to a PaaS resource can require approval by the resource owner, especially across subscriptions or tenants. When a partner subscription creates a Private Endpoint toward the canal authority’s SQL logical server and the connection sits at Pending, approve or reject that private-endpoint connection on the SQL resource rather than opening the public firewall for the partner.
Opening the SQL firewall to the partner’s public IP range so Pending can be ignored fails the private connectivity intent. Enabling TDE to auto-approve cross-subscription Private Endpoints fails by concept—TDE is encryption at rest. Granting the partner Owner on the canal subscription so Pending becomes Approved automatically fails least privilege.
Exam caveat: pending Private Endpoint connections are a control point—do not bypass with public firewall holes. Operational check: review the pending connection, approve if justified, confirm partner connectivity via private IP, and leave public SQL access restricted. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.