Finance wants Azure SQL and storage reachable only from inside the city’s Virtual Network, not from the open internet. Which feature provides that private access pattern?

A private endpoint assigns a private IP address inside a Virtual Network to a PaaS service such as Azure SQL or Storage, so clients on that VNet and connected networks can reach the service privately without relying on the public internet path. Finance’s requirement that SQL and storage be reachable only from inside the city’s VNet matches that private access pattern for sensitive backend data. A public endpoint faces the internet and is the wrong default when the goal is VNet-only reachability for those systems. Azure Advisor recommendations do not themselves implement private IPs or replace networking changes needed for private access. Azure Virtual Desktop host pools deliver desktops to users; they do not replace private endpoints for SQL and storage data planes. Private endpoints are a cornerstone of locking down municipal backends. Exam caveat: after introducing private endpoints, teams often disable or tightly restrict public network access—leaving public access wide open can undermine the private-only intent. Operational check: create private endpoints for the SQL server and storage account in the finance subnet, confirm private DNS resolves to private IPs, and verify a test query succeeds from a VNet-joined client while public internet attempts fail as designed.